Riskcovery

CVE-2023-54218

net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().

State
Published
Severity
Not scored
Published
Dec 30, 2025
Updated
May 11, 2026
Reserved
Dec 30, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().

KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE().

BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg

write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0: sock_write_timestamp include/net/sock.h:2670 [inline] sock_recv_cmsgs include/net/sock.h:2722 [inline] packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc

read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1: sock_recv_cmsgs include/net/sock.h:2721 [inline] packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc

value changed: 0xffffffffc4653600 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before fd28692fa182d25e8d26bc1db506648839fde245Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before 564c3150ad357d571a0de7d8b644aa1f7e6e21b7Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before d7343f8de019ebb55b2b6ef79b971f6ceb361a99Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before d06f67b2b8dcd00d995c468428b6bccebc5762d8Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before de260d1e02cde39d317066835ee6e5234fc9f5a8Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before 7145f2309d649ad6273b9f66448321b9b4c523c8Affected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before 8319220054e5ea5f506d8d4c4b5e234f668ffc3bAffected
  • 6c7c98bad4883a4a8710c96b2b44de482865eb6e to before dfd9248c071a3710c24365897459538551cb7167Affected
LinuxLinux
  • 4.12Affected
  • before 4.12Not affected
  • 4.14.316 through 4.14.*Not affected
  • 4.19.284 through 4.19.*Not affected
  • 5.4.244 through 5.4.*Not affected
  • 5.10.181 through 5.10.*Not affected
  • 5.15.113 through 5.15.*Not affected
  • 6.1.30 through 6.1.*Not affected
  • 6.3.4 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.