CVE-2026-53223 (GCVE-0-2026-53223)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: cdaf15b43bd31003220cb080bcbbd57787a2fca9 Version: 4.10.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24a0d548d3a765cd4558224e4f8e06e14cba26e3",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "71ff5cdd5da61d0438e902aa0fd68c28bc901abe",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "ad9a0374ee6d11048e1f74cd5180bad58b9848b4",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "b903e9b5629ec8dd6db92174070045bf81ad7060",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "e0665b2a8e90bb08bd205062c75662b502d31797",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "3dde4fb941fa5649ab809f6cd3e20e0c424a4e31",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "1ee90b77b727df903033db873c75caac5c27ec98",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"status": "affected",
"version": "cdaf15b43bd31003220cb080bcbbd57787a2fca9",
"versionType": "git"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.\nAC:L - The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.\nPR:L - Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.\nS:U - The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.\nC:H - The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb-\u003elen bytes from skb-\u003edata even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.\nI:N - The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.\nA:H - The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:15.752Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"
},
{
"url": "https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"
},
{
"url": "https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"
},
{
"url": "https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"
},
{
"url": "https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"
},
{
"url": "https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"
},
{
"url": "https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"
},
{
"url": "https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"
}
],
"title": "net: guard timestamp cmsgs to real error queue skbs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53223",
"datePublished": "2026-06-25T08:39:24.588Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:15.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…