CVE-2026-98289 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.") changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint (unix_vertex.scc_index).
unix_vertex_dead() assumes all vertices in an SCC share the same lowpoint, but this is not always true if an SCC has two or more back edges, depending on the order of DFS.
For example, the graph below has two back edges from B to A and from C to B.
A --> B --> C ^ | ^ | `----' `----'
If DFS walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A), each index and scc_index will be updated as follows.
A --> B --> C C = (3, 3) (index, scc_index) B = (2, 2) A = (1, 1)
A ... B ... C C = (3, 2)<-. ^ | B = (2, 2) -' `----' A = (1, 1)
A ... B ... C C = (3, 2) ^ | . . B = (2, 1)<-. `----' .... A = (1, 1) -'
Then, unix_vertex_dead() thinks that B is passed to another SCC with scc_index 2, and the SCC is not garbage-collected.
This does not happen if DFS walks in a different order below or starts from B.
1 3 A --> B --> C ^ | ^ | `----' `----' 2 4
Let's unify scc_index across the SCC when finalising it.
Note that updating v->index was previously done in unix_scc_dead(), when called from __unix_walk_scc(), just to save one loop. Since __unix_walk_scc() now iterates over the SCC anyway, the update is moved back to __unix_walk_scc() and 'fast' argument is dropped.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability described involves a logic error in the Linux kernel's Unix domain socket implementation, specifically within the Strongly Connected Components (SCC) detection algorithm used for garbage collection of circular references. The core issue stems from an inconsistency in how SCC indices are assigned to vertices during the finalization phase of Tarjan’s algorithm as implemented in the __unix_walk_scc function. While commit bfdb01283ee8 attempted to optimize the assignment by updating lowlink values, it inadvertently introduced a scenario where vertices within the same strongly connected component could end up with different scc_index values depending on the depth-first search traversal order and the presence of multiple back edges. This inconsistency violates the fundamental assumption held by unix_vertex_dead that all vertices belonging to an SCC share a uniform identifier for their component group.
The operational impact of this flaw is primarily related to memory management inefficiencies rather than direct security exploitation such as privilege escalation or remote code execution. When the scc_index values are not unified, the garbage collection mechanism incorrectly determines that certain objects belong to different components. Consequently, these circular references fail to be identified as a complete cycle eligible for cleanup. This leads to reference counts remaining elevated and prevents the kernel from reclaiming memory associated with those socket structures. Over time, particularly in systems handling high volumes of Unix domain socket connections or complex networking topologies involving frequent creation and destruction of such sockets, this can result in gradual memory leaks within the kernel space.
From a technical classification perspective, this issue aligns with CWE-401, which describes missing release of memory after effective usage, often referred to as a memory leak. The underlying algorithmic flaw relates to incorrect state management during graph traversal and component identification. In terms of adversarial tactics, while not directly exploitable for attack purposes in the traditional sense, such vulnerabilities can contribute to resource exhaustion scenarios if an attacker can trigger specific socket creation patterns that exploit this logic error repeatedly. This falls under the broader category of Denial of Service via resource consumption, though it requires significant volume and timing precision to be impactful against a robust system with adequate memory reserves.
The resolution involves unifying the scc_index across all vertices within an SCC at the time of finalization in __unix_walk_scc. By ensuring that every vertex in a detected cycle receives the same identifier regardless of traversal order, the unix_vertex_dead function can correctly identify and collect these circular references. The fix also refactors the code to move index updates back into the main walk loop, removing an optimization flag that was contributing to the inconsistent state. This change ensures deterministic behavior for garbage collection logic irrespective of DFS path variations caused by multiple back edges in complex socket dependency graphs.
To mitigate this vulnerability, system administrators and developers should ensure that Linux kernels are updated with the patch corresponding to commit bfdb01283ee8 or later versions where this specific fix is integrated. For systems running older kernel versions that cannot be immediately patched, monitoring for unusual memory growth in kernel space associated with network subsystems can serve as an indicator of potential exploitation through resource exhaustion. Regular audits of socket usage patterns and ensuring proper cleanup procedures in application code using Unix domain sockets can further reduce the risk of triggering this specific garbage collection failure mode.