CVE-2026-23394 is a Linux kernel vulnerability in the af_unix subsystem related to garbage collection (GC) of socket connections. The problem occurs when MSG_PEEK is used on a socket, which increments the file descriptor's reference count without interacting with GC. This leads to a race condition where GC may incorrectly determine that sockets in a strongly connected component (SCC) are dead and purge their receive queues, even though they are still alive. The race involves concurrent operations by the GC thread and user threads performing MSG_PEEK and close() calls. The fix avoids reintroducing locking by using a seqcount_t memory barrier to notify GC of MSG_PEEK activity, allowing GC to defer collection to a subsequent run. This resolves the race condition without imposing performance penalties on MSG_PEEK calls.

The vulnerability can cause the Linux kernel's garbage collector to prematurely purge the receive queue of live Unix domain sockets due to a race condition involving MSG_PEEK and socket closure. This may lead to denial of service conditions by disrupting socket communication. The CVSS score of 4.7 (medium severity) reflects a local attack vector requiring high complexity and low privileges, with no confidentiality or integrity impact but with potential availability impact.

A patch is available for this vulnerability and should be applied. The vendor advisory from Ubuntu confirms that the issue is fixed in Linux kernel versions 6.17.0-29.29 and later for various Ubuntu releases including 22.04 LTS and 25.10. Users should update their systems using standard package management tools and reboot to apply the kernel updates. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation steps are required beyond applying the official fixes.