INFRA Signal 434
AF_UNIX container escape bug resurrected twice by kernel refactoring and incomplete fixes
↗
A socket-buffer use-after-free in AF_UNIX that enables container escape has been exploited across three iterations over ten years, resurrected each time by refactoring that removed prior fixes.
Each time the kernel community refactored the AF_UNIX garbage collector, the fix for this class of bug was silently deleted, re-opening a container escape path. The pattern shows how clean rewrites can reintroduce known vulnerabilities, and how partial fixes leave exploitable windows on unpatched kernels below 6.19.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
CVE-2021-0920 fixed an MSG_PEEK race with the AF_UNIX GC using a lock barrier that serialized peek against collection runs.
A 2024 GC rewrite using Tarjan's SCC algorithm removed the lock dance as apparently unnecessary, resurrecting the same use-after-free.
The subsequent fix (CVE-2026-23394) relied on a buggy gc_in_progress flag, and CVE-2026-53361 showed that fix was also insufficient.
THE CLUSTER