CVE-2023-52654

io_uring/af_unix: disable sending io_uring over sockets

State: Published
Severity: 7.8 High
Published: May 9, 2024
Updated: Aug 5, 2026
Reserved: Mar 6, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/af_unix: disable sending io_uring over sockets

File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	04df9719df1865f6770af9bc7880874af0e594b2 to before 18824f592aad4124d79751bbc1500ea86ac3ff29Affected c378c479c5175833bb22ff71974cda47d7b05401 to before 3fe1ea5f921bf5b71cbfdc4469fb96c05936610eAffected 813d8fe5d30388f73a21d3a2bf46b0a1fd72498c to before bcedd497b3b4a0be56f3adf7c7542720eced0792Affected 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before f2f57f51b53be153a522300454ddb3887722fb2cAffected 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before 5a33d385eb36991a91e3dddb189d8679e2aac2beAffected 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before 705318a99a138c29a512a72c3e0043b3cd7f55f4Affected b4293c01ee0d0ecdd3cb5801e13f62271144667aAffected 75e94c7e8859e58aadc15a98cc9704edff47d4f2Affected 5.4.220 to before 5.4.264Affected 5.10.150 to before 5.10.204Affected 5.15.75 to before 5.15.143Affected 5.19.17 to before 5.20Affected 6.0.3 to before 6.1Affected
LinuxLinux	6.1Affected before 6.1Not affected 5.4.264 through 5.4.Not affected 5.10.204 through 5.10.Not affected 5.15.143 through 5.15.Not affected 6.1.68 through 6.1.Not affected 6.6.7 through 6.6.*Not affected 6.7 and laterNot affected

Product

Versions

LinuxLinux

04df9719df1865f6770af9bc7880874af0e594b2 to before 18824f592aad4124d79751bbc1500ea86ac3ff29Affected
c378c479c5175833bb22ff71974cda47d7b05401 to before 3fe1ea5f921bf5b71cbfdc4469fb96c05936610eAffected
813d8fe5d30388f73a21d3a2bf46b0a1fd72498c to before bcedd497b3b4a0be56f3adf7c7542720eced0792Affected
0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before f2f57f51b53be153a522300454ddb3887722fb2cAffected
0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before 5a33d385eb36991a91e3dddb189d8679e2aac2beAffected
0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 to before 705318a99a138c29a512a72c3e0043b3cd7f55f4Affected
b4293c01ee0d0ecdd3cb5801e13f62271144667aAffected
75e94c7e8859e58aadc15a98cc9704edff47d4f2Affected
5.4.220 to before 5.4.264Affected
5.10.150 to before 5.10.204Affected
5.15.75 to before 5.15.143Affected
5.19.17 to before 5.20Affected
6.0.3 to before 6.1Affected

LinuxLinux

6.1Affected
before 6.1Not affected
5.4.264 through 5.4.*Not affected
5.10.204 through 5.10.*Not affected
5.15.143 through 5.15.*Not affected
6.1.68 through 6.1.*Not affected
6.6.7 through 6.6.*Not affected
6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.