High [CVE-2026-53005] Drop all SCM attributes for SOCKMAP

In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC.

When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets.

Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list.

In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that unix_edge.successor is always alive, which is no longer true once skb is redirected, resulting in use-after-free below. [0] Moreover, SOCKMAP does not call scm_stat_del() properly, so unix_show_fdinfo() could report an incorrect fd count. sk_msg_recvmsg() does not support any SCM attributes in the first place.

A flaw was found in the Linux kernel's af_unix component, specifically within its SOCKMAP feature. This vulnerability stems from the kernel's improper handling of Socket Control Message (SCM) attributes when data is passed to the SOCKMAP layer.

This can lead to a use-after-free condition, which may allow an attacker to cause system instability or a denial of service.