CVE-2026-53223 net: guard timestamp cmsgs to real error queue skbs
A local attacker with AF_PACKET access and timestamping enabled can read adjacent heap memory due to incorrect error queue skb handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53223?
CVE-2026-53223 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership.
Weakness: CWE-125
Which versions are affected by CVE-2026-53223?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53223?
Apply the vendor's patch.
Is CVE-2026-53223 being exploited?
There is no known exploitation of CVE-2026-53223 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53223, DEBIAN-CVE-2026-53223, GHSA-9mph-4hqc-xqx7, ROOT-OS-DEBIAN-11-CVE-2026-53223, ROOT-OS-DEBIAN-12-CVE-2026-53223, ROOT-OS-UBUNTU-2204-CVE-2026-53223 and 2 more.