Linux AF_UNIX GC vs MSG_PEEK Use-After-Free Container Escape (CVE-2026-53361)

CVE-2026-53361 is a use-after-free in the Linux AF_UNIX socket garbage collector triggered via a MSG_PEEK race. The GC reclaims in-flight sockets forming unreachable reference cycles, but a concurrent MSG_PEEK can take a reference the GC census never counts. The gc_in_progress flag the peek checks can read false mid-run, letting the peek slip through and creating a dangling sk_buff. This is the same class of bug fixed as CVE-2021-0920 and CVE-2026-23394, with the final fix in commit d82ba05263c6.

The exploit achieves unprivileged container escape through a multi-stage attack: SLUB heap grooming for co-location, KASLR bypass via leaked kernel pointers, dirty pagetable technique for arbitrary kernel memory write, and privilege escalation to root in the init namespace via core_pattern handler hijacking.

Root Cause

The AF_UNIX GC reclaims in-flight socket file descriptors that form unreachable reference cycles. A concurrent MSG_PEEK on an in-flight fd takes a reference the collector never counted, so the GC can free a socket that is still alive, leaving a dangling sk_buff. The peek is supposed to back off while a collection runs, but the gc_in_progress flag it checks can transiently read false mid-run.

Attack Flow

1. Race setup: Build AF_UNIX socket graph with in-flight fds forming a reference cycle
2. GC race (race#1): Race MSG_PEEK against garbage collection to create dangling sk_buff
3. SLUB spray (race#2): Reclaim freed object with controlled data using cg-4k xattr spray to leak kernel pointers
4. KASLR defeat: Extract anon_pipe_buf_ops, vmemmap_base, and page_offset_base from leaked heap data
5. Dirty pagetable (race#3): Use leaked offsets to forge pipe_buf_operations and hijack page table entries
6. Container escape: Overwrite core_pattern to point at the exploit binary, crash a child process to trigger root shell in init namespace