CVE-2024-26750 is a vulnerability identified in the Linux kernel's af_unix subsystem, specifically within the garbage collection function __unix_gc(). The issue arises from improper handling of out-of-band socket buffers (oob_skb) during the purging of socket queues. The vulnerability manifests as a task hang caused by a logic flaw in a while loop that processes candidate socket buffers for cleanup. The loop assumes all candidates have an oob_skb reference and that calling kfree_skb(oob_skb) will release all remaining candidates. However, a particular edge case involving self-referencing file descriptors (fd) and ordering of socket buffers in the candidate list causes the loop to stall indefinitely, resulting in a hung kernel worker thread. This hang occurs because the loop never progresses when an oob_skb has a self-referencing fd and another fd precedes it in the candidate list. The fix involves dropping the oob_skb reference before purging the queue, allowing __skb_queue_purge() to correctly release all inflight sockets and prevent the hang. The vulnerability was reported by syzbot and affects Linux kernel versions identified by specific commit hashes. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The issue affects the Linux kernel's internal socket garbage collection mechanism, which is critical for resource management and system stability.

For European organizations relying on Linux-based systems, this vulnerability could lead to kernel worker threads hanging, potentially causing degraded system performance or denial of service conditions. Systems that heavily utilize Unix domain sockets for inter-process communication, such as servers running container orchestration platforms, microservices architectures, or complex middleware, are particularly at risk. A hung kernel worker thread may not immediately crash the system but can lead to resource exhaustion or stalled services, impacting availability and operational continuity. Given Linux's widespread use in enterprise servers, cloud infrastructure, and embedded devices across Europe, the vulnerability could affect critical infrastructure, financial services, telecommunications, and public sector systems. While there is no evidence of remote code execution or privilege escalation, the denial of service impact on kernel stability is significant, especially in high-availability environments. The lack of requirement for user interaction or authentication to trigger the hang (assuming local processes can create the affected socket conditions) increases the risk within multi-tenant or shared environments.

European organizations should prioritize applying the official Linux kernel patches that address this vulnerability as soon as they become available. In the interim, system administrators should monitor kernel worker thread activity and system logs for signs of hung tasks related to __unix_gc or socket garbage collection. Implementing kernel live patching solutions where feasible can reduce downtime associated with patch deployment. Additionally, organizations should audit and limit the use of Unix domain sockets in untrusted or less controlled environments to reduce exposure. Employing container runtime security best practices, such as restricting capabilities and isolating workloads, can mitigate the risk of local exploitation. Regularly updating Linux distributions to incorporate upstream kernel fixes and maintaining robust system monitoring and alerting for kernel anomalies will further reduce impact. Finally, engaging with Linux distribution vendors and security mailing lists can provide timely information on patch availability and vulnerability status.