Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf
Summary
| CVE | CVE-2023-6531 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-21 10:15:07 UTC |
| Updated | 2026-08-06 22:16:38 UTC |
| Description | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. |
Risk And Classification
Primary CVSS: v3.1 7 HIGH from [email protected]
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.002240000 probability, percentile 0.130580000 (date 2026-08-09)
Problem Types: CWE-362 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Linux | Linux Kernel | 6.7 | rc1 | All | All |
| Operating System | Linux | Linux Kernel | 6.7 | rc2 | All | All |
| Operating System | Linux | Linux Kernel | 6.7 | rc3 | All | All |
| Operating System | Linux | Linux Kernel | 6.7 | rc4 | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:5.14.0-427.13.1.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:5.14.0-427.13.1.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 2253034 – (CVE-2023-6531) CVE-2023-6531 kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| packetstormsecurity.com/files/176533/Linux-Broken-Unix-GC-Interaction-Use-After-Free.... | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | |
| lists.debian.org/debian-lts-announce/2024/01/msg00005.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| access.redhat.com/errata/RHSA-2024:2394 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [PATCH 1/1] io_uring/af_unix: disable sending io_uring over sockets - Pavel Begunkov | af854a3a-2127-422b-91ae-364da2661108 | lore.kernel.org | Mailing List, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-12-05T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2023-12-06T06:30:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 200099 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6624-1)
- 200116 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6639-1)
- 200132 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-6652-1)
- 6000418 Debian Security Update for linux (DSA 5593-1)
- 6000419 Debian Security Update for linux (DSA 5594-1)
- 6000428 Debian Security Update for linux-5.10 (DLA 3711-1)
- 673723 EulerOS Security Update for kernel (EulerOS-SA-2024-1237)
- 673992 EulerOS Security Update for kernel (EulerOS-SA-2024-1215)
- 755604 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0129-1)
- 755607 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0115-1)
- 755747 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0469-1)
- 755754 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0516-1)
- 755756 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0514-1)
- 756012 SUSE Enterprise Linux Security Update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP5) (SUSE-SU-2024:0989-1)
- 756013 SUSE Enterprise Linux Security Update for the Linux Kernel RT (Live Patch 6 for SLE 15 SP5) (SUSE-SU-2024:0986-1)
- 756014 SUSE Enterprise Linux Security Update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP5) (SUSE-SU-2024:0995-1)
- 756015 SUSE Enterprise Linux Security Update for the Linux Kernel RT (Live Patch 8 for SLE 15 SP5) (SUSE-SU-2024:0991-1)
- 756028 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 2 for SLE 15 SP5) (SUSE-SU-2024:1023-1)
- 756029 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 30 for SLE 15 SP3) (SUSE-SU-2024:1017-1)
- 756030 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 6 for SLE 15 SP5) (SUSE-SU-2024:1045-1)
- 756031 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 8 for SLE 15 SP5) (SUSE-SU-2024:1040-1)
- 756032 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 0 for SLE 15 SP5) (SUSE-SU-2024:1039-1)
- 756033 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 40 for SLE 15 SP3) (SUSE-SU-2024:1033-1)
- 756034 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 35 for SLE 15 SP3) (SUSE-SU-2024:1047-1)
- 756035 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 41 for SLE 15 SP3) (SUSE-SU-2024:1054-1)
- 756036 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 43 for SLE 15 SP2) (SUSE-SU-2024:1053-1)
- 756040 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 21 for SLE 15 SP4) (SUSE-SU-2024:1072-1)
- 756041 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 18 for SLE 15 SP4) (SUSE-SU-2024:1063-1)
- 756047 SUSE Enterprise Linux Security Update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP5) (SUSE-SU-2024:1097-1)
- 756135 SUSE Enterprise Linux Security Update for the Linux Kernel (Live Patch 42 for SLE 15 SP3) (SUSE-SU-2024:1276-1)
- 907993 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (33963-1)