net: guard timestamp cmsgs to real error queue skbs

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-53223
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-06-25 09:16:40 UTC
Updated2026-06-25 09:16:40 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership.

Risk And Classification

EPSS: 0.001840000 probability, percentile 0.081710000 (date 2026-06-25)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc 24a0d548d3a765cd4558224e4f8e06e14cba26e3 git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc 71ff5cdd5da61d0438e902aa0fd68c28bc901abe git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc ad9a0374ee6d11048e1f74cd5180bad58b9848b4 git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc b903e9b5629ec8dd6db92174070045bf81ad7060 git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc e0665b2a8e90bb08bd205062c75662b502d31797 git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc 3dde4fb941fa5649ab809f6cd3e20e0c424a4e31 git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a git Not specified
CNA Linux Linux affected 8605330aac5a5785630aec8f64378a54891937cc 1ee90b77b727df903033db873c75caac5c27ec98 git Not specified
CNA Linux Linux affected cdaf15b43bd31003220cb080bcbbd57787a2fca9 git Not specified
CNA Linux Linux affected 4.10.14 4.11 semver Not specified
CNA Linux Linux affected 4.11 Not specified
CNA Linux Linux unaffected 4.11 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.94 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.36 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.13 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report