af_unix: fix struct pid leaks in OOB support
Published May 2, 2025
7.1
HIGHCVSS 3.1
EPSS 0.19%
Description
syzbot reported struct pid leak [1].
Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid.
But skb->destructor is not set (either directly or by calling unix_scm_to_skb())
This means that subsequent kfree_skb() or consume_skb() would leak this reference.
In this fix, I chose to fully support scm even for the OOB message.
[1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff812ae26a>] alloc_pid+0x6a/0x560 kernel/pid.c:180 [<ffffffff812718df>] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [<ffffffff81272b37>] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [<ffffffff812730cc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [<ffffffff849ad699>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff849ad699>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.15StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.15
- Version 5.15.103StatusunaffectedConstraints<=5.15.*
- Version 6.1.20StatusunaffectedConstraints<=6.1.*
- Version 6.2.7StatusunaffectedConstraints<=6.2.*
- Version 6.3StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
- ≥ 5.15 · < 5.15.103
- ≥ 5.16 · < 6.1.20
- ≥ 6.2 · < 6.2.7
- 6.3
No data.
Red Hat Enterprise Linux 10
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel-rt
Out of support scope
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
A memory leak in the AF_UNIX OOB message handling was fixed in queue_oob(). When SCM credentials were attached to an OOB message, a missing call to unix_scm_to_skb() resulted in leaked struct pid references, as skb->destructor was not set. The issue was reported by Syzbot and required a process to send OOB messages with SCM credentials. Local attackers with the ability to create UNIX domain sockets and send OOB messages can trigger a kernel memory leak.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
1 other source (Red Hat) ▾
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2025–2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.19% (0.00194) | 8.22th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.15% (0.00152) | 4.65th | v5 (v2026.06.15) |
| May 3, 2025 | 0.02% (0.00018) | 3.10th | v4 (v2025.03.14) |
References (9)
- https://access.redhat.com/security/cve/CVE-2023-53136 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2363726 Issue Tracking
- https://git.kernel.org/stable/c/2aab4b96900272885bc157f8b236abf1cdc02e08 Patch
- https://git.kernel.org/stable/c/a59d6306263c38e5c0592ea4451ca26a0778c947 Patch
- https://git.kernel.org/stable/c/ac1968ac399205fda9ee3b18f7de7416cb3a5d0d Patch
- https://git.kernel.org/stable/c/f3969427fb06a2c3cd6efd7faab63505cfa76e76 Patch
- https://lore.kernel.org/linux-cve-announce/2025050236-CVE-2023-53136-74ee@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2023-53136
- https://www.cve.org/CVERecord?id=CVE-2023-53136
Change history (0)
No recorded changes yet.