Medium 5.5Published Jun 24, 2026

CVE-2026-52928af_unix: Reject SIOCATMARK on non-stream sockets

Updated under an hour ago (Oct 27, 2026, 7:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: af_unix: Reject SIOCATMARK on non-stream sockets SIOCATMARK reports whether the receive queue is at the urgent mark for MSG_OOB. In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets. SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(), so they should not support SIOCATMARK either. Return -EOPNOTSUPP for non-stream sockets before checking the receive queue.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 314001f0bf927015e459c9d387d62a231fe93af3 before ec123873fdc83e7244c8ed6d17b8f8ea6c416a67; from 314001f0bf927015e459c9d387d62a231fe93af3 before f085971de6d6b8ef946a5e0bcd73ff24509a0f85; from 314001f0bf927015e459c9d387d62a231fe93af3 before b741c9c6ef59f17c1f104ddf1217ef77f79ed29b; 314001f0bf927015e459c9d387d62a231fe93af3 builds before 645b1ed3259af38b7814242a420bc2081bdd1eb6; from 314001f0bf927015e459c9d387d62a231fe93af3 before c34c41446acf6c0d13b5b06c809be11e0f7f2729; 314001f0bf927015e459c9d387d62a231fe93af3 builds before 3147ddf5a41c20c45c2eb69e00b62f10f822056a; from 314001f0bf927015e459c9d387d62a231fe93af3 before d119775f2bad827edc28071c061fdd4a91f889a5	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.15 before 5.15.211; from 5.16 before 6.1.177; from 6.2 before 6.6.144; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/ec123873fdc83e7244c8ed6d17b8f8ea6c416a67	patch
https://git.kernel.org/stable/c/f085971de6d6b8ef946a5e0bcd73ff24509a0f85	patch
https://git.kernel.org/stable/c/b741c9c6ef59f17c1f104ddf1217ef77f79ed29b	patch
https://git.kernel.org/stable/c/645b1ed3259af38b7814242a420bc2081bdd1eb6	patch
https://git.kernel.org/stable/c/c34c41446acf6c0d13b5b06c809be11e0f7f2729	patch
https://git.kernel.org/stable/c/3147ddf5a41c20c45c2eb69e00b62f10f822056a	patch
https://git.kernel.org/stable/c/d119775f2bad827edc28071c061fdd4a91f889a5	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.