In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix garbage collector racing against connect()
Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCMRIGHTS, two consecutive passes of scanchildren() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gcinflightlist.
sockets are AFUNIX/SOCKSTREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped
connect(S, addr) sendmsg(S, [V]); close(V) _unixgc() ---------------- ------------------------- -----------
NS = unixcreate1() skb1 = sockwmalloc(NS) L = unixfindother(addr) unixstatelock(L) unix_peer(S) = NS // V count=1 inflight=0
        NS = unix_peer(S)
        skb2 = sock_alloc()
        skb_queue_tail(NS, skb2[V])
        // V became in-flight
        // V count=2 inflight=1
        close(V)
        // V count=1 inflight=1
        // GC candidate condition met
                    for u in gc_inflight_list:
                      if (total_refs == inflight_refs)
                        add u to gc_candidates
                    // gc_candidates={L, V}
                    for u in gc_candidates:
                      scan_children(u, dec_inflight)
                    // embryo (skb1) was not
                    // reachable from L yet, so V's
                    // inflight remains unchanged
_skbqueuetail(L, skb1) unixstateunlock(L) for u in gccandidates: if (u.inflight) scanchildren(u, incinflightmovetail)
                    // V count=1 inflight=2 (!)
If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCMRIGHTS. At this point, unixinflight() can not happen because unixgclock is already taken. Inflight graph remains unaffected.
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c2678228f6aec74b305ae30c9374cc2f28a51",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-153ea339",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47d8ac011fe1c9251070e1bd64cb10b48193ec51",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-18c58423",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "122920127131213858102134753415047248769",
                "319908282437410479085541387421506056779",
                "278940835524629575759825104918924838702",
                "100682501803387475719901164668727951322",
                "283013095320175714379169964006468018027",
                "206688331583033760130838952328910362633",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e2a03787f4f0abc0072350654ab0ef3324d9db3",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-575680ce",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e2a03787f4f0abc0072350654ab0ef3324d9db3",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-631d6aa8",
        "digest": {
            "length": 1938.0,
            "function_hash": "208102392801727682837033639742828568898"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a36ae0ec2353015f0f6762e59f4c2dbc0c906423",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-66f71c0b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507cc232ffe53a352847893f8177d276c3b532a9",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-69bf3785",
        "digest": {
            "length": 2089.0,
            "function_hash": "316026394728532231166056187935696610553"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47d8ac011fe1c9251070e1bd64cb10b48193ec51",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "__unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-9460d657",
        "digest": {
            "length": 1676.0,
            "function_hash": "27682202121951841194007484691936494877"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b75722be422c276b699200de90527d01c602ea7c",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-94fbfaa5",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a36ae0ec2353015f0f6762e59f4c2dbc0c906423",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-96bfb47b",
        "digest": {
            "length": 1645.0,
            "function_hash": "215147063308967458301514025733541609798"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdf7bec5c920200077d693193f989cb1513f009",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-96f1e226",
        "digest": {
            "length": 2089.0,
            "function_hash": "316026394728532231166056187935696610553"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdf7bec5c920200077d693193f989cb1513f009",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-9ab470cb",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343c5372d5e17b306db5f8f3c895539b06e3177f",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-9ffcdf48",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343c5372d5e17b306db5f8f3c895539b06e3177f",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-a05fd709",
        "digest": {
            "length": 1938.0,
            "function_hash": "208102392801727682837033639742828568898"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b75722be422c276b699200de90527d01c602ea7c",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-b2400398",
        "digest": {
            "length": 2066.0,
            "function_hash": "202148699059998200178298428058688701248"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507cc232ffe53a352847893f8177d276c3b532a9",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-c287d364",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247313632362000557681439634814653617003",
                "225240012471257624316609982004119038788",
                "237475675945084381784996008223390676253",
                "45357760908702270405087243136282333814",
                "198347599488074683909057318167912198406",
                "107858477545749964358376846251504242693",
                "244993795812341974696846497482787712037",
                "115611268172369308342931816655427995262",
                "304613538574637326588055915306575351528",
                "130247343054700722034937596086818004261"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c2678228f6aec74b305ae30c9374cc2f28a51",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "unix_gc",
            "file": "net/unix/garbage.c"
        },
        "id": "CVE-2024-26923-c9274289",
        "digest": {
            "length": 2066.0,
            "function_hash": "202148699059998200178298428058688701248"
        },
        "signature_type": "Function"
    }
]