AF_UNIX is a Linux socket family used for local inter-process communication on the same host. Unlike TCP or UDP, it is not designed for network traffic across machines. Programs use AF_UNIX sockets to exchange data efficiently, and they can also pass file descriptors and other privileged handles between processes.
In cyber security, AF_UNIX matters because it is part of the kernel’s local attack surface. A bug in this subsystem can affect processes that never open a network port, including containerized workloads that share the host kernel. Memory-safety flaws such as use-after-free can lead to crashes, corruption, privilege escalation, or container escape if an attacker can reach the vulnerable code path. Defenders reduce risk by patching the kernel promptly, limiting what untrusted workloads can do with seccomp and MAC policies such as AppArmor, and treating container isolation as a layer on top of, not a replacement for, host hardening.