VulnSocial

CVE-2026-53361PoC(linux / linux_kernel)

MEDIUMCVSS 7.1 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch linux linux_kernel systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().

linux CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-362

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 11 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 7 signals
  • PoC mentioned or linked in 9 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 10 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 6 mentions (2026-08-12); latest day: 2
  • 11 total mentions across 5 days

Affected systems

Vendors
linux
Products
linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline11 mentions / 5d
02356Mentions · 2026-07-26: 1Mentions · 2026-08-12: 6Mentions · 2026-08-13: 1Mentions · 2026-08-18: 1Mentions · 2026-08-27: 2PoC Mentioned / Linked · 2026-08-12: 5PoC Mentioned / Linked · 2026-08-13: 1PoC Mentioned / Linked · 2026-08-18: 1PoC Mentioned / Linked · 2026-08-27: 2Exploit Tool / Code · 2026-08-12: 4Exploit Tool / Code · 2026-08-13: 1Exploit Tool / Code · 2026-08-18: 1Exploit Tool / Code · 2026-08-27: 1Patch / Workaround · 2026-07-26: 1Patch / Workaround · 2026-08-12: 1Patch / Workaround · 2026-08-18: 1Technical Details · 2026-07-26: 1Technical Details · 2026-08-12: 5Technical Details · 2026-08-13: 1Technical Details · 2026-08-18: 1Technical Details · 2026-08-27: 207-2608-1208-1308-1808-27
Signal classification4 categories
PoC
872.7%
Patch
19.1%
Disclosure
19.1%
General
19.1%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-261
Patch1
2026-08-126
Disclosure1General1PoC4
2026-08-131
PoC1
2026-08-181
PoC1
2026-08-272
PoC2
Full discourse11 posts
  • dbugs@ptdbugs
    PoC

    A PoC/exploit has been discovered for vulnerability CVE-2026-53361 Vendor: Linux Product: Linux Description: A race condition exists in the af unix module where the unix gc() function could execute while the gc in progress variable is false. This occurs if garbage collection work is scheduled while a previous instance of the function is already running. This state can lead to issues in the unix peek fpl() function, which depends on the gc in progress flag to prevent MSG PEEK from interfering with the garbage collection process. Link: https://github.com/sgkdev/bad_garbage #dbugs_vuln

    Post summary

    A proof‑of‑concept exploit for CVE‑2026‑53361 has been published, including code, but no active exploitation or patch information is reported.

    011051226.0K
    3.6K followersView on X
  • Hack32@Hack32_
    PoC

    CVE-2026-53361: PoC Exploit Enables AF_UNIX Container Escape https://securityonline.info/cve-2026-53361-container-escape/?utm_source=twitter&utm_medium=social_share

    Post summary

    The post announces a PoC exploit that enables a Unix domain socket container escape for CVE‑2026‑53361; no vendor patch or evidence of live exploitation is mentioned.

    06041143.6K
    828 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 Linux kernel'de BadGarbage: CVE-2026-53361 Linux kernel'deki Unix socket garbage collector'da bulunan CVE-2026-53361 (BadGarbage) açığı için çalışan bir PoC yayımlandı. Açığın CVSS skoru 7.0 (High). Bu açıktan CloudLinux 10, AlmaLinux 10 ve Ubuntu 24.04/26.04 dahil olmak üzere bazı Linux dağıtımları etkileniyor. Açık, uygun koşullarda bir saldırganın kernel seviyesinde root yetkisi elde etmesine ve container içinden host'a kaçmasına olanak sağlayabiliyor. Özellikle shared hosting ve çok kullanıcılı sunucular için ciddi risk oluşturuyor. 📌 CloudLinux, Almalinux gibi dağıtımlar patch yayınladı, etkilenen sistemleri kullananlar mutlaka güncelleme yapsın. PoC: https://github.com/sgkdev/bad_garbage

    Post summary

    CVE‑2026‑53361, a kernel‑level RCE allowing container escape, has a publicly available PoC on GitHub, and patches are released for affected Linux distributions.

    05025101.6K
    2.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    A public PoC for CVE-2026-53361 turns an AF_UNIX kernel race into a local container escape on Linux. Details and exploit code are now disclosed. #CVE202653361 #ContainerEscape #LinuxKernel #AFUNIX #UseAfterFree #KernelExploit https://securityonline.info/cve-2026-53361-container-escape/

    Post summary

    A public proof‑of‑concept and exploit code for CVE‑2026‑53361 has been released, demonstrating a local container escape via an AF_UNIX kernel race.

    150197990
    13.0K followersView on X
  • NanoVMs@nanovms
    General

    been quite the day for the containerati... CVE-2026-53361 https://t.co/fJLMAAEXFJ

    Post summary

    The tweet merely references CVE-2026-53361 with a link but offers no further technical, exploit, or patch information.

    00074612
    2.3K followersView on X
  • blueblue@piedpiper1616
    PoC

    GitHub - sgkdev/bad_garbage: CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape · GitHub - https://github.com/sgkdev/bad_garbage

    Post summary

    The GitHub repository sgkdev/bad_garbage provides a proof‑of‑concept and exploit code for CVE‑2026‑53361, a use‑after‑free container escape related to AF_UNIX handling.

    02031720
    5.5K followersView on X
  • -ENOMEM@masami256
    PoC

    sgkdev/bad_garbage: CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape https://github.com/sgkdev/bad_garbage

    Post summary

    The GitHub repository hosts a PoC for CVE‑2026‑53361, a use‑after‑free container escape via AF_UNIX; no active exploitation or patch information is provided.

    00011331
    2.4K followersView on X
  • Frank@jedisct1
    PoC

    CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape https://github.com/sgkdev/bad_garbage

    Post summary

    A use‑after‑free container escape vulnerability (CVE-2026-53361) is documented with a publicly available PoC on GitHub, but no evidence of active exploitation, patching, or false‑positive status is present.

    00011669
    17.5K followersView on X
  • Abhiram Gannavaram@AbhiramGannava2
    Disclosure

    CVE-2026-53361: third AF-UNIX GC patch in five years. A flag is not a lock. Public container-escape PoC targets RHEL 10 (6.12) and Ubuntu 24.04 HWE (6.17). Patch now.

    Post summary

    CVE-2026-53361 is a container-escape vulnerability, publicly demonstrated via a PoC targeting RHEL 10 and Ubuntu 24.04, and a vendor patch has been issued.

    0000051
    113 followersView on X
  • TechNowPulse@TechNowPulse
    PoC

    CVE-2026-53361 AF_Unix GC vs. MSG_PEEK use-after-free container escape https://github.com/sgkdev/bad_garbage #Tech #Ai

    Post summary

    The post highlights a proof‑of‑concept exploit for CVE-2026-53361, linking to a GitHub repository that likely contains the exploit code, and outlines the technical nature of the vulnerability.

    0000034
    49 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-53361 - Linux kernel af_unix race condition (CVSS 7.1). Allows local attackers to trigger integrity/availability issues via garbage collection bypass. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/lw312HD0fV

    Post summary

    The tweet highlights a high‑severity race condition in the Linux kernel (CVE‑2026‑53361) that could lead to integrity/availability issues for local attackers, and urges users to apply a patch immediately.

    0000032
    96 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---
OSlinuxlinux_kernel7.1--
OSlinuxlinux_kernel7.1--

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities