// HACKER NEWS — CYBERSECURITY
CVE-2026-53361 AF_Unix GC vs. MSG_PEEK use-after-free container escape
CVE-2026-53361 — an unprivileged, container-escapable use-after-free in the
AF_UNIX socket garbage collector. This is the single-vector (MSG_PEEK only)
version.
The AF_UNIX GC reclaims "in-flight" sockets that form unreachable reference
cycles. A concurrent MSG_PEEK on an in-flight fd takes a reference the GC's
census never counts, so the collector can free a socket that is still alive and
leave a dangling sk_buff. The peek is supposed to back off while a collection
runs, but the gc_in_progress flag it checks can read false mid-run, so the
peek slips through and the race is open.
Vulnerable = affected by the bug. Targeted = covered by this exploit
(single MSG_PEEK vector). The 7.x kernels and the Ubuntu 6.8 GA kernel are
vulnerable but out of scope here.