Look up another CVE · open CVE-2026-53223 in the interactive tracker
CVE-2026-53223
net: guard timestamp cmsgs to real error queue skbs
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem include/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53223 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/net/sock.h
net/core/skbuff.c
net/socket.c
- What this is
- NETWORKING [SOCKETS]MAINTAINERS section matched on include/net/sock.h · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.11 | 5.10.259 | 24a0d548d3a7 |
| 4.11 | 5.15.210 | 71ff5cdd5da6 |
| 4.11 | 6.1.176 | ad9a0374ee6d |
| 4.11 | 6.6.143 | b903e9b5629e |
| 4.11 | 6.12.94 | e0665b2a8e90 |
| 4.11 | 6.18.36 | 3dde4fb941fa |
| 4.11 | 7.0.13 | eb51a9ad3ceb |
| 4.11 | 7.1 | 1ee90b77b727 |
| 4.10.14 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
| DLA-4664-1 | 2026-07-03 | bullseye 5.10.259-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.
- AC:LAttack complexity, low
- The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.
- PR:LPrivileges required, low
- Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.
- UI:NUser interaction, none
- No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.
- S:UScope, unchanged
- The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.
- C:HConfidentiality impact, high
- The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb->len bytes from skb->data even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.
- I:NIntegrity impact, none
- The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.
- A:HAvailability impact, high
- The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High.