CVE-2026-53361CWE-362

CVE-2026-53361

High · published July 4, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Set gc_in_progress to true in unix_gc().

Igor Ushakov reported that unix_gc() could run with gc_in_progress

being false if the work is scheduled while running:

Thread 1 Thread 2 Thread 3

-------- -------- --------

unix_schedule_gc() unix_schedule_gc()

`- if (!gc_in_progress) `- if (!gc_in_progress)

|- gc_in_progress = true |

`- queue_work() |

unix_gc() <----------------/ |

| |- gc_in_progress = true

... `- queue_work()

| |

`- gc_in_progress = false |

|

unix_gc() <---------------------------------------------'

|

... /* gc_in_progress == false */

|

`- gc_in_progress = false

unix_peek_fpl() relies on gc_in_progress not to confuse GC

by MSG_PEEK.

Let's set gc_in_progress to true in unix_gc().

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00178 · 7.0th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-07-04T16:17Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.141, < 6.26.2
linux/linux_kernel≥ 6.6.93, < 6.6.1446.6.144
linux/linux_kernel≥ 6.9, < 6.12.956.12.95
linux/linux_kernel≥ 6.13, < 6.18.386.18.38
linux/linux_kernel≥ 6.19, < 7.17.1
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
EPSS history
Timeline
  • 04 JUL 11:54Z
    af_unix: Set gc_in_progress to true in unix_gc().
    cvelistv5