{"id":"CVE-2026-53223","summary":"net: guard timestamp cmsgs to real error queue skbs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership.","modified":"2026-11-12T02:31:06.044095885Z","published":"2026-06-25T08:39:24.588Z","related":["ALSA-2026:66180","ALSA-2026:68531","ALSA-2026:68532","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","SUSE-SU-2026:4282-1","openSUSE-SU-2026:21910-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53223.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"},{"type":"WEB","url":"https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"},{"type":"WEB","url":"https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53223.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53223"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8605330aac5a5785630aec8f64378a54891937cc"},{"fixed":"24a0d548d3a765cd4558224e4f8e06e14cba26e3"},{"fixed":"71ff5cdd5da61d0438e902aa0fd68c28bc901abe"},{"fixed":"ad9a0374ee6d11048e1f74cd5180bad58b9848b4"},{"fixed":"b903e9b5629ec8dd6db92174070045bf81ad7060"},{"fixed":"e0665b2a8e90bb08bd205062c75662b502d31797"},{"fixed":"3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"},{"fixed":"eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"},{"fixed":"1ee90b77b727df903033db873c75caac5c27ec98"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.10.14"},{"fixed":"4.11"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"cdaf15b43bd31003220cb080bcbbd57787a2fca9"}]}],"versions":["v4.10.17","v4.10.16","v4.10.15","v4.10.14"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53223.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53223.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}