The flaw is a race condition in the Linux kernel’s af_unix module that allows a diagnostic request to read the inode and device numbers of a UNIX socket while its path reference is still held. The race arises because the kernel reads UNIX_DIAG_VFS data while holding the unix_state_lock mutex, then releases the lock before emitting the netlink reply. The patch ensures that the data is read while the lock is held and that the reply is constructed only after the lock is released, keeping the VFS information stable and preventing the exposure of sensitive metadata.

All Linux kernel releases that include the unpatched af_unix code are affected, as indicated by the provided CPE list. This means every kernel version up to and including 7.0 rc7, as well as all earlier stable releases, is vulnerable if it has not applied the diagnostic fix.

The CVSS score of 7.8 signals a serious potential impact, yet the EPSS score of less than 1 % indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker with the ability to send netlink diagnostic messages to the af_unix module could trigger the race and capture inode and device numbers. The disclosed information could aid in further enumeration but does not directly grant higher privileges or cause a crash.