Description
In the Linux kernel, the following vulnerability has been resolved:

af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().

Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.")
changed Tarjan's algorithm to update lowlink with lowlink,
which is called lowpoint (unix_vertex.scc_index).

unix_vertex_dead() assumes all vertices in an SCC share the same
lowpoint, but this is not always true if an SCC has two or more
back edges, depending on the order of DFS.

For example, the graph below has two back edges from B to A
and from C to B.

A --> B --> C
^ | ^ |
`----' `----'

If DFS walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A),
each index and scc_index will be updated as follows.

A --> B --> C C = (3, 3) (index, scc_index)
B = (2, 2)
A = (1, 1)

A ... B ... C C = (3, 2)<-.
^ | B = (2, 2) -'
`----' A = (1, 1)

A ... B ... C C = (3, 2)
^ | . . B = (2, 1)<-.
`----' .... A = (1, 1) -'

Then, unix_vertex_dead() thinks that B is passed to another
SCC with scc_index 2, and the SCC is not garbage-collected.

This does not happen if DFS walks in a different order below
or starts from B.

1 3
A --> B --> C
^ | ^ |
`----' `----'
2 4

Let's unify scc_index across the SCC when finalising it.

Note that updating v->index was previously done in unix_scc_dead(),
when called from __unix_walk_scc(), just to save one loop. Since
__unix_walk_scc() now iterates over the SCC anyway, the update is
moved back to __unix_walk_scc() and 'fast' argument is dropped.
Published: 2026-10-06
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (resource exhaustion)
Action: Apply patch
AI Analysis

Impact

The Linux kernel’s AF_UNIX subsystem contains a bug in SCC index handling during traversal that can prevent sockets from being garbage‑collected. Based on the description, it is inferred that an attacker could create many AF_UNIX sockets and exhaust kernel resources, potentially leading to a denial of service. The impact is therefore a loss of availability due to resource exhaustion.

Affected Systems

All Linux kernel distributions running a version that does not include commit bfdb01283ee8. The vulnerability affects only the kernel’s AF_UNIX implementation and is not limited to a particular vendor or distribution.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5 but an EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local privileged or local unprivileged access, as creating AF_UNIX sockets requires kernel file descriptor privileges. Based on the description, it is inferred that exploitation would need local access; no remote exploitation is indicated. The current exploitation probability appears low due to lack of publicly reported exploits, yet the impact remains severe if the resource exhaustion succeeds, potentially crashing affected services or the entire system.

Generated by OpenCVE AI on October 9, 2026 at 14:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes commit bfdb01283ee8 that fixes the SCC index handling bug
  • If a kernel update is not yet available, monitor /proc/net/unix for abnormal growth of unused socket entries and consider rebooting or restarting affected services to recover resources
  • Check vendor security advisories for interim updates or patches and apply them when released

Generated by OpenCVE AI on October 9, 2026 at 14:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 06 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.") changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint (unix_vertex.scc_index). unix_vertex_dead() assumes all vertices in an SCC share the same lowpoint, but this is not always true if an SCC has two or more back edges, depending on the order of DFS. For example, the graph below has two back edges from B to A and from C to B. A --> B --> C ^ | ^ | `----' `----' If DFS walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A), each index and scc_index will be updated as follows. A --> B --> C C = (3, 3) (index, scc_index) B = (2, 2) A = (1, 1) A ... B ... C C = (3, 2)<-. ^ | B = (2, 2) -' `----' A = (1, 1) A ... B ... C C = (3, 2) ^ | . . B = (2, 1)<-. `----' .... A = (1, 1) -' Then, unix_vertex_dead() thinks that B is passed to another SCC with scc_index 2, and the SCC is not garbage-collected. This does not happen if DFS walks in a different order below or starts from B. 1 3 A --> B --> C ^ | ^ | `----' `----' 2 4 Let's unify scc_index across the SCC when finalising it. Note that updating v->index was previously done in unix_scc_dead(), when called from __unix_walk_scc(), just to save one loop. Since __unix_walk_scc() now iterates over the SCC anyway, the update is moved back to __unix_walk_scc() and 'fast' argument is dropped.
Title af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:17:00.475Z

Reserved: 2026-09-25T10:25:14.336Z

Link: CVE-2026-98289

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:19.177

Modified: 2026-10-19T10:18:30.560

Link: CVE-2026-98289

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98289 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T14:45:07Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime