{"apiVersion":"1.0","identifier":"CVE-2026-80521","description":"In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--- 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--- ^..- but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--- ^--- However, X-s SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B-s scc_entry. Let-s unlink scc_entry before freeing the vertex in unix_del_edge().","publishedAt":"2026-08-26T15:17:05","lastModifiedAt":"2026-08-27T06:17:30","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80521","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.0012,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80521","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80521","en":"https://www.redsauce.net/en/cves/CVE-2026-80521","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80521","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80521","de":"https://www.redsauce.net/de/cves/CVE-2026-80521","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80521","el":"https://www.redsauce.net/el/cves/CVE-2026-80521"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80521"}}