Unix GC Remastered

The Linux kernel's AF_UNIX garbage collector was recently rewritten to use a graph-based Strongly-Connected-Components model to reclaim unreachable sockets that were sent between processes but remain trapped in kernel memory. The garbage collector is triggered when too many sockets are "in flight" (sent but not yet accepted) or when a socket closes, and it identifies collectable sockets by comparing their file reference counts to their "inflight" counts. Despite the rewrite, the subsystem remains prone to bugs, including a Use-After-Free vulnerability that the article discusses.