CVE-2026-31673 af_unix: read UNIX_DIAG_VFS data under unix_state_lock
A race condition in the Linux kernel's UNIX domain socket diagnostics allows attackers to read unstable VFS data, potentially leaking sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31673?
CVE-2026-31673 is a high-severity vulnerability in Linux kernel, published on 25 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking.
Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock.
This keeps the VFS data stable while the reply is being built.
Weakness: CWE-362
Which versions are affected by CVE-2026-31673?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31673?
Apply the vendor's patch.
Is CVE-2026-31673 being exploited?
There is no known exploitation of CVE-2026-31673 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-84234, BELL-CVE-2026-31673, DEBIAN-CVE-2026-31673, GHSA-pcr3-grpm-hh36, ROOT-OS-DEBIAN-11-CVE-2026-31673, ROOT-OS-DEBIAN-12-CVE-2026-31673 and 3 more.