CVE Explorer

CVE-2026-64109

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7950d253b0317cfe5fea9e4a53ac90a493324fc0ebc23cdc9bfb4ac41bf8ff0e

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/unix/af_unix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqua…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/unix/af_unix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"26342087fac93b3932e6af61dc91ec029cb8a623","status":"affected","version":"2b514574f7e88c8498027ee366fd6e7aae5aa4b5","versionType":"git"},{"lessThan":"38bccb927d83d7d52e5b20015a172a0b6101d11e","status":"affected","version":"2b514574f7e88c8498027ee366fd6e7aae5aa4b5","versionType":"git"},{"lessThan":"acdff9907478e82208475b1151700d0b71dcdc63","status":"affected","version":"2b514574f7e88c8498027ee366f…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/metrics/0/cvssV3_1

Source references

5 source assertions

{"url":"https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6aa9d1094156662fb71851b0c5901ccd3c7e1ac294fc8a616678ecf4cb95663d · sha256:7ccf8f9641590457… · /containers/cna/references/4

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer