Linux kernel BPF sockmap: use-after-free on the af_unix peer when a socket closes during iteration

Impact

A BPF iterator program that updates a sockmap can race unix_release_sock(): the iterator reads unix_peer(sk), the closing path clears the peer pointer and drops its reference, and the iterator then calls sock_hold() on freed memory. The KASAN report in the record shows a confirmed slab-use-after-free write of 4 bytes in unix_stream_bpf_update_proto reached through sock_map_update_elem from a BPF iterator - this one is demonstrated, not theoretical. Sockmap and af_unix iteration are what eBPF service meshes and socket-redirect datapaths do, so the exposed component on a GPU cluster is the networking agent running on every node rather than the tenant workload. A controlled write into freed slab memory from a privileged kernel context is the shape that leads to host compromise; the fix takes the state lock so the iterator always sees a stable socket.

Who can reach it

Local. Requires the ability to load and run BPF iterator programs that update a sockmap - CAP_BPF/CAP_SYS_ADMIN, in practice the CNI, service mesh or observability agent. Racing it needs a concurrent af_unix close, which an attacker on the same node controls.

What to do

Patch to a fixed stable or distribution kernel and reboot. Red Hat tracks it for RHEL 6 through 10. If you run an eBPF-based CNI or mesh that uses sockmap with af_unix, that agent is the exposure, so the kernel reboot is the only real fix - disabling the agent is usually worse than the bug. Drain and reboot per node.

References

Related entries

• Linux kernel BPF: sock_ops same-register context access leaks a kernel pointer and reads out of boundsCVE-2026-53078 · Linux kernel BPF sock_ops context access (SOCK_OPS_GET_SK / SOCK_OPS_GET_FIELD)High
• Linux kernel BPF verifier: inconsistent ADD_CONST base ids let unsafe state pruning succeedCVE-2026-53081 · Linux kernel BPF verifier (regsafe base-id consistency for BPF_ADD_CONST scalars)High
• Linux kernel BPF task_vma iterator: mm_struct used without a reference, freed under the iteratorCVE-2026-53085 · Linux kernel BPF (open-coded task_vma iterator, mm_struct lifecycle)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High