CVE-2026-53223

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: guard timestamp cmsgs to real error queue skbs<br /> <br /> skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb<br /> from sk_error_queue. That assumption is not true for AF_PACKET sockets:<br /> outgoing packet taps are also delivered to packet sockets with<br /> skb-&gt;pkt_type == PACKET_OUTGOING, but their skb-&gt;cb is owned by AF_PACKET<br /> instead of struct sock_exterr_skb.<br /> <br /> If such an skb is received with timestamping enabled, the generic<br /> timestamp cmsg path can read AF_PACKET control-buffer state as<br /> sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop<br /> counter overlaps opt_stats. An odd drop count makes the path emit<br /> SCM_TIMESTAMPING_OPT_STATS with skb-&gt;len and skb-&gt;data. For non-linear<br /> skbs this copies past the linear head and can trigger hardened usercopy or<br /> disclose adjacent heap contents.<br /> <br /> Keep skb_is_err_queue() local to net/socket.c, but make it verify that<br /> the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor<br /> installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal<br /> receive ownership and no longer pass as error-queue skbs, while legitimate<br /> sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free<br /> ownership.