Unverified50% confidenceFactExact time
In the Linux kernel, each network socket is represented as a file descriptor; when a process forks a child process, the child inherits the parent's file descriptor table via a reference-counting mechanism, causing port leaks to survive across processes.
1
Sources
50%
Confidence
Long-term
Relevance
8/9/2026
First Seen
Sources
Cursor端口泄漏：Linux下600+端口转发未清理的排查与解决
Related Claims
UnverifiedAs long as any process holds a reference to a socket file descriptor, the corresponding socket will not be reclaimed by the kernel—this is the underlying mechanism by which port leaks can survive across processes.76% similarUnverifiedLinux内核包含超过2800万行代码，容器共享同一宿主内核，内核漏洞可能成为逃逸路径69% similarUnverifiedWhen a parent process exits without properly closing its sockets, if child processes have inherited these file descriptors, they will be kept in a LISTEN or ESTABLISHED state indefinitely, causing port forwarding to become orphaned.65% similarUnverifiedThe chroot mechanism in Unix systems restricts the scope of file system access by changing a process's root directory, and is one of the earliest sandbox prototypes.65% similarUnverifiedUnix domain sockets support passing file descriptors (fd passing) via sendmsg/recvmsg.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/714030API
curl https://kongchang.com/api/v1/knowledge/claims/714030MCP
get_claim(id=714030)