CVE-2023-53109

net: tunnels: annotate lockless accesses to dev->needed_headroom

State: Published
Severity: Not scored
Published: May 2, 2025
Updated: May 11, 2026
Reserved: May 2, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tunnels: annotate lockless accesses to dev->needed_headroom

IP tunnels can apparently update dev->needed_headroom in their xmit path.

This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers.

More changes might be needed for completeness.

BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit

read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/i ---truncated---

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8eb30be0352d09165e94a41fef1c7b994dca0714 to before 8e206f66d824b3b28a7f9ee1366dfc79a937bb46Affected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before 51f3bd3765bc5ca4583af07a00833da00d2ace1dAffected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before 5aaab217c8f5387b9c5fff9e940d80f135e04366Affected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before be59b87ee4aed81db7c10e44f603866a0ac3ca5dAffected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before e0a557fc1daf5c1086e47150a4571aebadbb62beAffected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before a69b72b57b7d269e833e520ba7500d556e8189b6Affected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before 9b86a8702b042ee4e15d2d46375be873a6a8834fAffected 8eb30be0352d09165e94a41fef1c7b994dca0714 to before 4b397c06cb987935b1b097336532aa6b4210e091Affected
LinuxLinux	4.7Affected before 4.7Not affected 4.14.311 through 4.14.Not affected 4.19.279 through 4.19.Not affected 5.4.238 through 5.4.Not affected 5.10.176 through 5.10.Not affected 5.15.104 through 5.15.Not affected 6.1.21 through 6.1.Not affected 6.2.8 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

8eb30be0352d09165e94a41fef1c7b994dca0714 to before 8e206f66d824b3b28a7f9ee1366dfc79a937bb46Affected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before 51f3bd3765bc5ca4583af07a00833da00d2ace1dAffected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before 5aaab217c8f5387b9c5fff9e940d80f135e04366Affected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before be59b87ee4aed81db7c10e44f603866a0ac3ca5dAffected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before e0a557fc1daf5c1086e47150a4571aebadbb62beAffected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before a69b72b57b7d269e833e520ba7500d556e8189b6Affected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before 9b86a8702b042ee4e15d2d46375be873a6a8834fAffected
8eb30be0352d09165e94a41fef1c7b994dca0714 to before 4b397c06cb987935b1b097336532aa6b4210e091Affected

LinuxLinux

4.7Affected
before 4.7Not affected
4.14.311 through 4.14.*Not affected
4.19.279 through 4.19.*Not affected
5.4.238 through 5.4.*Not affected
5.10.176 through 5.10.*Not affected
5.15.104 through 5.15.*Not affected
6.1.21 through 6.1.*Not affected
6.2.8 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.