In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.
References
Configurations
Configuration 1 (hide)
|
History
02 Jul 2026, 20:47
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98 - Patch | |
| References | () https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3 - Patch | |
| References | () https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31 - Patch | |
| References | () https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe - Patch | |
| References | () https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4 - Patch | |
| References | () https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060 - Patch | |
| References | () https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797 - Patch | |
| References | () https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.11:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
28 Jun 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
25 Jun 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 09:16
Updated : 2026-07-02 20:47
NVD link : CVE-2026-53223
Mitre link : CVE-2026-53223
CVE.ORG link : CVE-2026-53223
JSON object : View
Products Affected
linux
- linux_kernel
CWE