CVE-2026-97985
Description
A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by triggering an infinite busy-wait loop on the system. When processing local Unix domain sockets (AF_UNIX) containing out-of-band (OOB) data, the kernel fails to update internal queue markers during certain receive operations. Consequently, the affected thread repeatedly attempts to read data without properly waiting, resulting in excessive CPU consumption.
Statement
Red Hat rates this Linux kernel flaw, which affects the AF_UNIX (Unix domain socket) implementation in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, as LOW severity. A local unprivileged user can create an AF_UNIX stream socketpair, send out-of-band (OOB) data, and issue blocking recv() calls (including with MSG_PEEK). In certain sequences, manage_oob() skips the OOB skb without updating the internal last-skb marker, so unix_stream_data_wait() returns immediately instead of sleeping; the receiving thread then busy-waits in a tight loop and consumes excessive CPU, causing a local denial of service. The issue is limited to CPU consumption on the local host: AF_UNIX sockets provide local inter-process communication and are not network reachable, and there is no memory corruption, information disclosure, or privilege escalation. Although the CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) corresponds to Moderate, Red Hat assesses the overall severity as LOW given the limited, availability-only local impact. The fix is deferred for the affected RHEL 10 and Red Hat In-Vehicle OS streams because of this low severity; the residual risk is that a local user could degrade system performance or availability by repeatedly triggering the busy-wait. RHEL 7 through RHEL 9 kernels (including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present, and RHEL 6 is out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
