CVE-2026-97985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97985", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.208Z", "datePublished": "2026-09-25T10:23:20.173Z", "dateUpdated": "2026-10-21T12:53:57.548Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:57.548Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Update last skb marker in manage_oob().\n\nFahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU\ndue to OOB skb.\n\nIn the following cases, manage_oob() skips OOB skb(s) and returns\nNULL for the last recv(MSG_PEEK):\n\n socketpair(AF_UNIX, SOCK_STREAM, 0, sk);\n\n 1) skb -> OOB skb -> NULL\n send(sk[0], \"ab\", 2, MSG_OOB);\n recv(sk[1], buf, 0, MSG_PEEK);\n\n 2) skb -> consumed OOB skb -> NULL\n send(sk[0], \"ab\", 2, MSG_OOB);\n recv(sk[1], buf, 1, MSG_OOB);\n recv(sk[1], buf, 0, MSG_PEEK);\n\n 3) consumed OOB skb -> OOB skb -> NULL\n send(sk[0], \"a\", 1, MSG_OOB);\n recv(sk[1], buf, 0, MSG_OOB);\n send(sk[0], \"b\", 1, MSG_OOB);\n recv(sk[1], buf, 1, MSG_PEEK);\n\nThen, @copied is 0 in unix_stream_read_generic() (zero-length buffer,\nor non-OOB skb is not yet consumed), and unix_stream_data_wait() is\ncalled.\n\nHowever, it returns immediately because @last is not updated in\nunix_stream_read_generic(), and the thread busy-waits for a new skb.\n\nLet's update @last in manage_oob().\n\nFor MSG_PEEK, @last is updated with the skipped OOB, and for the\nnon-peek case, @last matches the returned value (when !copied)\nbecause OOB is unlinked.\n\nNote that manage_oob() is inlined and no stack canary is added."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/unix/af_unix.c"], "versions": [{"version": "022d81a709cd553bbe2db8675f8e824f4aee6284", "lessThan": "bd91dc313afe21e9d6b31ca6a47606a33ca5e35c", "status": "affected", "versionType": "git"}, {"version": "22dd70eb2c3d754862964377a75abafd3167346b", "lessThan": "0630bfc773d85ac44da05b2c5a037dbbd39301ab", "status": "affected", "versionType": "git"}, {"version": "22dd70eb2c3d754862964377a75abafd3167346b", "lessThan": "f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa", "status": "affected", "versionType": "git"}, {"version": "22dd70eb2c3d754862964377a75abafd3167346b", "lessThan": "fc62a26493a98a0424d9dae2eb92a1daa1321f65", "status": "affected", "versionType": "git"}, {"version": "22dd70eb2c3d754862964377a75abafd3167346b", "lessThan": "94fd4debd2e3a69cf93e766c8b328a810c228119", "status": "affected", "versionType": "git"}, {"version": "ae3f9e1221b31b18dbd4c4b85d08574996bbd973", "status": "affected", "versionType": "git"}, {"version": "ba0db4638525b8b054b3d546b45f7e473f477027", "status": "affected", "versionType": "git"}, {"version": "16dc252e7007547a7b72a2c21022ef81fb45e6a3", "status": "affected", "versionType": "git"}, {"version": "6.6.29", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "5.15.157", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.88", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.8.8", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/unix/af_unix.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.29", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bd91dc313afe21e9d6b31ca6a47606a33ca5e35c"}, {"url": "https://git.kernel.org/stable/c/0630bfc773d85ac44da05b2c5a037dbbd39301ab"}, {"url": "https://git.kernel.org/stable/c/f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa"}, {"url": "https://git.kernel.org/stable/c/fc62a26493a98a0424d9dae2eb92a1daa1321f65"}, {"url": "https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}], "title": "af_unix: Update last skb marker in manage_oob().", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/unix/af_unix.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bd91dc313afe21e9d6b31ca6a47606a33ca5e35c", "status": "affected", "version": "022d81a709cd553bbe2db8675f8e824f4aee6284", "versionType": "git"}, {"lessThan": "0630bfc773d85ac44da05b2c5a037dbbd39301ab", "status": "affected", "version": "22dd70eb2c3d754862964377a75abafd3167346b", "versionType": "git"}, {"lessThan": "f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa", "status": "affected", "version": "22dd70eb2c3d754862964377a75abafd3167346b", "versionType": "git"}, {"lessThan": "fc62a26493a98a0424d9dae2eb92a1daa1321f65", "status": "affected", "version": "22dd70eb2c3d754862964377a75abafd3167346b", "versionType": "git"}, {"lessThan": "94fd4debd2e3a69cf93e766c8b328a810c228119", "status": "affected", "version": "22dd70eb2c3d754862964377a75abafd3167346b", "versionType": "git"}, {"status": "affected", "version": "ae3f9e1221b31b18dbd4c4b85d08574996bbd973", "versionType": "git"}, {"status": "affected", "version": "ba0db4638525b8b054b3d546b45f7e473f477027", "versionType": "git"}, {"status": "affected", "version": "16dc252e7007547a7b72a2c21022ef81fb45e6a3", "versionType": "git"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.29", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.157", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.88", "versionType": "semver"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/unix/af_unix.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Update last skb marker in manage_oob().\n\nFahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU\ndue to OOB skb.\n\nIn the following cases, manage_oob() skips OOB skb(s) and returns\nNULL for the last recv(MSG_PEEK):\n\n socketpair(AF_UNIX, SOCK_STREAM, 0, sk);\n\n 1) skb -> OOB skb -> NULL\n send(sk[0], \"ab\", 2, MSG_OOB);\n recv(sk[1], buf, 0, MSG_PEEK);\n\n 2) skb -> consumed OOB skb -> NULL\n send(sk[0], \"ab\", 2, MSG_OOB);\n recv(sk[1], buf, 1, MSG_OOB);\n recv(sk[1], buf, 0, MSG_PEEK);\n\n 3) consumed OOB skb -> OOB skb -> NULL\n send(sk[0], \"a\", 1, MSG_OOB);\n recv(sk[1], buf, 0, MSG_OOB);\n send(sk[0], \"b\", 1, MSG_OOB);\n recv(sk[1], buf, 1, MSG_PEEK);\n\nThen, @copied is 0 in unix_stream_read_generic() (zero-length buffer,\nor non-OOB skb is not yet consumed), and unix_stream_data_wait() is\ncalled.\n\nHowever, it returns immediately because @last is not updated in\nunix_stream_read_generic(), and the thread busy-waits for a new skb.\n\nLet's update @last in manage_oob().\n\nFor MSG_PEEK, @last is updated with the skipped OOB, and for the\nnon-peek case, @last matches the returned value (when !copied)\nbecause OOB is unlinked.\n\nNote that manage_oob() is inlined and no stack canary is added."}], "id": "CVE-2026-97985", "lastModified": "2026-10-21T13:21:18.350", "metrics": {}, "published": "2026-09-25T11:17:26.560", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0630bfc773d85ac44da05b2c5a037dbbd39301ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd91dc313afe21e9d6b31ca6a47606a33ca5e35c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc62a26493a98a0424d9dae2eb92a1daa1321f65"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: af_unix: Update last skb marker in manage_oob()", "id": "2541307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541307"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["In the Linux kernel, the following vulnerability has been resolved:\naf_unix: Update last skb marker in manage_oob().\nFahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU\ndue to OOB skb.\nIn the following cases, manage_oob() skips OOB skb(s) and returns\nNULL for the last recv(MSG_PEEK):\nsocketpair(AF_UNIX, SOCK_STREAM, 0, sk);\n1) skb -> OOB skb -> NULL\nsend(sk[0], \"ab\", 2, MSG_OOB);\nrecv(sk[1], buf, 0, MSG_PEEK);\n2) skb -> consumed OOB skb -> NULL\nsend(sk[0], \"ab\", 2, MSG_OOB);\nrecv(sk[1], buf, 1, MSG_OOB);\nrecv(sk[1], buf, 0, MSG_PEEK);\n3) consumed OOB skb -> OOB skb -> NULL\nsend(sk[0], \"a\", 1, MSG_OOB);\nrecv(sk[1], buf, 0, MSG_OOB);\nsend(sk[0], \"b\", 1, MSG_OOB);\nrecv(sk[1], buf, 1, MSG_PEEK);\nThen, @copied is 0 in unix_stream_read_generic() (zero-length buffer,\nor non-OOB skb is not yet consumed), and unix_stream_data_wait() is\ncalled.\nHowever, it returns immediately because @last is not updated in\nunix_stream_read_generic(), and the thread busy-waits for a new skb.\nLet's update @last in manage_oob().\nFor MSG_PEEK, @last is updated with the skipped OOB, and for the\nnon-peek case, @last matches the returned value (when !copied)\nbecause OOB is unlinked.\nNote that manage_oob() is inlined and no stack canary is added.", "A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by triggering an infinite busy-wait loop on the system. When processing local Unix domain sockets (AF_UNIX) containing out-of-band (OOB) data, the kernel fails to update internal queue markers during certain receive operations. Consequently, the affected thread repeatedly attempts to read data without properly waiting, resulting in excessive CPU consumption."], "name": "CVE-2026-97985", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97985\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97985.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22dd70eb2c3d754862964377a75abafd3167346b,0630bfc773d85ac44da05b2c5a037dbbd39301ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22dd70eb2c3d754862964377a75abafd3167346b,f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22dd70eb2c3d754862964377a75abafd3167346b,fc62a26493a98a0424d9dae2eb92a1daa1321f65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22dd70eb2c3d754862964377a75abafd3167346b,94fd4debd2e3a69cf93e766c8b328a810c228119)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ae3f9e1221b31b18dbd4c4b85d08574996bbd973"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ba0db4638525b8b054b3d546b45f7e473f477027"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "022d81a709cd553bbe2db8675f8e824f4aee6284"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "16dc252e7007547a7b72a2c21022ef81fb45e6a3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.157,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.88,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.29,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.8.8,6.9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-26T00:45:16.069788+00:00", "updated": "2026-10-01T04:30:18.645878+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}