CVE-2026-53223

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: guard timestamp cmsgs to real error queue skbs

skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb

from sk_error_queue. That assumption is not true for AF_PACKET sockets:

outgoing packet taps are also delivered to packet sockets with

skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET

instead of struct sock_exterr_skb.

If such an skb is received with timestamping enabled, the generic

timestamp cmsg path can read AF_PACKET control-buffer state as

sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop

counter overlaps opt_stats. An odd drop count makes the path emit

SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear

skbs this copies past the linear head and can trigger hardened usercopy or

disclose adjacent heap contents.

Keep skb_is_err_queue() local to net/socket.c, but make it verify that

the PACKET_OUTGOING marker is paired with the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References