Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-05 | 2 | Disclosure2 |
| 2026-03-06 | 1 | Disclosure1 |
| 2026-03-09 | 1 | Patch1 |
https://seclists.org/oss-sec/2026/q1/261 (CVE-2025-13350) is for: https://ssd-disclosure.com/lpe-via-refcount-imbalance-in-the-af_unix-of-ubuntus-kernel/ from last year
Post summary
The post links to a disclosure page for CVE‑2025‑13350, a local privilege escalation vulnerability in Ubuntu’s AF_UNIX kernel, but does not provide a PoC, exploit code, active exploitation claim, or patch details.
CVE-2025-13350 for Ubuntu Linux kernel https://www.openwall.com/lists/oss-security/2026/03/05/7 Incorrectly backported patch that caused [Ubuntu] to mix an old-style with a new-style garbage collector for Unix Domain Sockets. If you consume the upstream kernel directly, you're fine.
Post summary
CVE-2025-13350 arises from an incorrectly backported patch in Ubuntu’s kernel that mixes two garbage collector styles for Unix Domain Sockets; the recommended mitigation is to use the upstream kernel.
CVE-2025-13350 Local Privilege Escalation in Ubuntu Linux 6.8 via AF_UNIX Garbage Collector UAF https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-13350
Post summary
The post announces CVE-2025-13350, a local privilege escalation flaw in Ubuntu 6.8's AF_UNIX garbage collector, without providing any PoC, exploit code, patch, or evidence of active exploitation.
CVE-2025-13350 Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphan… https://www.cve.org/CVERecord?id=CVE-2025-13350
Post summary
The post references CVE-2025-13350, noting a commit affecting AF_UNIX processing in Ubuntu Linux 6.8, but provides no evidence of exploitation, patches, or a PoC.