Linux kernel af_unix stale oob_skb handling in OOB data path
CVE-2024-35970 is a Linux kernel vulnerability in the AF_UNIX socket subsystem's out-of-band (OOB) data handling. The bug is in the logic described as manage_oob(), where recvmsg() invoked without MSG_OOB checks whether the next skb is marked as OOB. When such an OOB skb is dequeued from the receive queue, the kernel fails to clear unix_sock(sk)->oob_skb, leaving a stale pointer/state reference behind. The issue has existed since the introduction of AF_UNIX OOB support and was exposed more clearly after later garbage-collection changes. In affected scenarios, a UNIX domain socket can send its own file descriptor as OOB data via SCM_RIGHTS, then trigger asynchronous close and garbage collection paths. Because the stale oob_skb state is retained after dequeue, the socket state becomes inconsistent with the receive queue contents, leading to incorrect OOB semantics, persistent EPOLLPRI signaling, and interaction with AF_UNIX garbage collection that can result in deadlock or unreclaimed garbage.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
High-severity kernel elevation-of-privilege issue in Net/EPoll subsystems referenced as part of the December 2025 Android bulletin’s kernel bug set.
High-severity Android kernel vulnerability referenced in the December 2025 bulletin as expanding the local kernel privilege-escalation attack surface.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.