CVE-2026-31673

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31673", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.130Z", "datePublished": "2026-04-25T08:46:49.246Z", "dateUpdated": "2026-10-19T18:56:03.514Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:20.351Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY requests for AF_UNIX diagnostics. It is not reachable from remote network packets; an attacker needs local code execution to create sockets and send netlink requests.\nAC:L - The race is attacker-controlled because one thread can repeatedly issue exact UNIX_DIAG requests with UDIAG_SHOW_VFS while another closes attacker-created pathname AF_UNIX sockets. No rare external condition is required beyond timing that can be retried.\nPR:L - Unprivileged users can create AF_UNIX sockets and NETLINK_SOCK_DIAG sockets, and the sock_diag netlink socket permits non-root diagnostic requests. No real root or init-namespace CAP_NET_ADMIN is required.\nUI:N - Exploitation does not require any victim action. The attacker can create, bind, query, unlink, and close the involved sockets directly.\nS:U - The bug is in the kernel AF_UNIX diagnostic path and impacts kernel resources within the same security authority. It is a standard local kernel vulnerability, not a VM, IOMMU, or sandbox boundary-crossing issue.\nC:H - The bug is a use-after-free/read-after-free of the AF_UNIX VFS path dentry, allowing stale kernel object pointers to be dereferenced and returned or used during netlink reply construction. Under the required kernel scoring guidance, UAFs are treated as high confidentiality impact.\nI:H - Although the immediate vulnerable operation reads VFS fields, it is a kernel use-after-free in attacker-controllable local object lifetime and race conditions. Following the required guidance and higher-severity rule, UAFs are scored as potentially enabling integrity compromise.\nA:H - The stale dentry or related VFS pointer can be dereferenced after path_put(), plausibly causing a kernel oops or panic. Repeated local triggering makes high availability impact defensible."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/unix/diag.c"], "versions": [{"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0", "status": "affected", "versionType": "git"}, {"version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "39897df386376912d561d4946499379effa1e7ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/unix/diag.c"], "versions": [{"version": "3.3", "status": "affected"}, {"version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"}, {"url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"}, {"url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"}, {"url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"}, {"url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"}, {"url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"}, {"url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"}, {"url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"}], "title": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:42.865Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:05.532062Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:56:03.514Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:42.865Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:05.532062Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:12:06.239Z"}}], "cna": {"title": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY requests for AF_UNIX diagnostics. It is not reachable from remote network packets; an attacker needs local code execution to create sockets and send netlink requests.\nAC:L - The race is attacker-controlled because one thread can repeatedly issue exact UNIX_DIAG requests with UDIAG_SHOW_VFS while another closes attacker-created pathname AF_UNIX sockets. No rare external condition is required beyond timing that can be retried.\nPR:L - Unprivileged users can create AF_UNIX sockets and NETLINK_SOCK_DIAG sockets, and the sock_diag netlink socket permits non-root diagnostic requests. No real root or init-namespace CAP_NET_ADMIN is required.\nUI:N - Exploitation does not require any victim action. The attacker can create, bind, query, unlink, and close the involved sockets directly.\nS:U - The bug is in the kernel AF_UNIX diagnostic path and impacts kernel resources within the same security authority. It is a standard local kernel vulnerability, not a VM, IOMMU, or sandbox boundary-crossing issue.\nC:H - The bug is a use-after-free/read-after-free of the AF_UNIX VFS path dentry, allowing stale kernel object pointers to be dereferenced and returned or used during netlink reply construction. Under the required kernel scoring guidance, UAFs are treated as high confidentiality impact.\nI:H - Although the immediate vulnerable operation reads VFS fields, it is a kernel use-after-free in attacker-controllable local object lifetime and race conditions. Following the required guidance and higher-severity rule, UAFs are scored as potentially enabling integrity compromise.\nA:H - The stale dentry or related VFS pointer can be dereferenced after path_put(), plausibly causing a kernel oops or panic. Repeated local triggering makes high availability impact defensible."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0", "versionType": "git"}, {"status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "39897df386376912d561d4946499379effa1e7ef", "versionType": "git"}], "programFiles": ["net/unix/diag.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.3"}, {"status": "unaffected", "version": "0", "lessThan": "3.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/unix/diag.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"}, {"url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"}, {"url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"}, {"url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"}, {"url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"}, {"url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"}, {"url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"}, {"url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "3.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:20.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31673", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:56:03.514Z", "dateReserved": "2026-03-09T15:48:24.130Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-25T08:46:49.246Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/unix/diag.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}, {"lessThan": "39897df386376912d561d4946499379effa1e7ef", "status": "affected", "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/unix/diag.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.3"}, {"lessThan": "3.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAB12062-558C-4570-A908-D71195858ADA", "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naf_unix: leer datos de UNIX_DIAG_VFS bajo unix_state_lock\n\nLas b\u00fasquedas de diagn\u00f3stico UNIX exactas mantienen una referencia al socket, pero no a u -> path. Mientras tanto, unix_release_sock() borra u -> path bajo unix_state_lock() y libera la referencia de la ruta despu\u00e9s de desbloquear.\n\nLeer los n\u00fameros de inodo y de dispositivo para UNIX_DIAG_VFS mientras se mantiene unix_state_lock(), luego emitir el atributo netlink despu\u00e9s de liberar el bloqueo.\n\nEsto mantiene los datos VFS estables mientras se construye la respuesta."}], "id": "CVE-2026-31673", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31673", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:12:05.532062Z", "version": "2.0.3"}}]}, "published": "2026-04-25T09:16:00.423", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: af_unix: read UNIX_DIAG_VFS data under unix_state_lock", "id": "2461752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461752"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel. A race condition in the `af_unix` component allows a local attacker to cause unstable Virtual File System (VFS) data when `UNIX_DIAG_VFS` data is handled. This occurs because inode and device numbers are read without consistently holding the `unix_state_lock()`, while `u->path` can be cleared. This instability could lead to information disclosure or a denial of service."], "name": "CVE-2026-31673", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31673\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31673\nhttps://lore.kernel.org/linux-cve-announce/2026042539-CVE-2026-31673-b5f6@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f7b0569460b7d8d01ca776430a00505a68b7584,b9232421a77a649c9376c99fdfc8cb7f79cad34c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f7b0569460b7d8d01ca776430a00505a68b7584,0c739f3785f84af695952c2bac8be2f45082c9b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f7b0569460b7d8d01ca776430a00505a68b7584,900a4e0910e98b8caef117d5df00471fa438dcf9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f7b0569460b7d8d01ca776430a00505a68b7584,bdf206e740bf2919d818f132c8c9cc7ed91d11c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f7b0569460b7d8d01ca776430a00505a68b7584,39897df386376912d561d4946499379effa1e7ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-27T22:45:15.241911+00:00", "updated": "2026-10-23T08:45:16.400771+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}