--- id: CVE-2026-53223 title: |- In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue summary: |- In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not… severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H' vendor: linux product: linux_kernel affected: - 'linux_kernel >= 4.10.14, < 4.11' - 'linux_kernel >= 4.11.1, < 5.10.259' - 'linux_kernel >= 5.11, < 5.15.210' - 'linux_kernel >= 5.16, < 6.1.176' - 'linux_kernel >= 6.2, < 6.6.143' - 'linux_kernel >= 6.7, < 6.12.94' - 'linux_kernel >= 6.13, < 6.18.36' - 'linux_kernel >= 6.19, < 7.0.13' - linux_kernel = 4.11 - linux_kernel = 7.1 patched: - linux_kernel 7.0.13 published: '2026-06-25' updated: '2026-09-08' sourceUpdated: '2026-09-08T09:18:14.723' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53223' references: - url: 'https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53223.json - url: 'https://access.redhat.com/security/cve/CVE-2026-53223' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492811' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53223' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53223' - url: >- https://lore.kernel.org/linux-cve-announce/2026062506-CVE-2026-53223-1c2e@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:64775' - url: 'https://access.redhat.com/errata/RHSA-2026:66180' - url: 'https://access.redhat.com/errata/RHSA-2026:68531' - url: 'https://access.redhat.com/errata/RHSA-2026:68532' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00128 epssPercentile: 0.02029 ingestedAt: '2026-07-03T13:02:28.063Z' cwe: - CWE-125 scores: nvd: 7.1 vendor: 7 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership. ## Affected - `linux_kernel >= 4.10.14, < 4.11` - `linux_kernel >= 4.11.1, < 5.10.259` - `linux_kernel >= 5.11, < 5.15.210` - `linux_kernel >= 5.16, < 6.1.176` - `linux_kernel >= 6.2, < 6.6.143` - `linux_kernel >= 6.7, < 6.12.94` - `linux_kernel >= 6.13, < 6.18.36` - `linux_kernel >= 6.19, < 7.0.13` - `linux_kernel = 4.11` - `linux_kernel = 7.1` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.13` ## Vendor advisories - **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53223.json) - **RHSA-2026:66180** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66180) - **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531) - **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532)