INFRA Signal 481
CVE-2026-53361 AF_Unix GC vs. MSG_PEEK use-after-free container escape
A single-vector use-after-free in the AF_UNIX socket garbage collector can be triggered by MSG_PEEK, enabling unprivileged container escape.
The bug allows code running inside an unprivileged container to break out of its isolation, compromising host security. Engineers must update affected kernels or apply the fix to prevent this escape path. The issue also highlights subtle race conditions in kernel memory management that can be overlooked in container hardening.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The AF_UNIX GC can free a socket still referenced by a concurrent MSG_PEEK, leaving a dangling sk_buff.
Vulnerable kernels include stable 6.12 (up to 6.12.94) and Ubuntu 24.04 GA 6.8, while Ubuntu 24.04 HWE 6.17 is also vulnerable but not targeted by the exploit.
The fix sets gc_in_progress to true in unix_gc(), requiring a kernel upgrade to patched releases such as 6.12.95.
THE CLUSTER