CVE-2023-52522

What it actually does

Missing RCU annotation on writer side in neigh_periodic_work allows store tearing when deleting RCU-protected neighbor entries from a list, leading to inconsistent reader views and potential use-after-free or memory corruption in the kernel neighbor cache.

Why it matters to the business

Linux systems handling network neighbor tables may experience crashes, instability, or limited privilege escalation under concurrent access; widespread in servers and devices but low observed exploitation risk reduces immediate operational disruption.

How an attack unfolds

An attacker with local or network-adjacent access triggers repeated neighbor table modifications while the periodic work function runs, exploiting the torn store to cause readers to dereference invalid pointers and corrupt kernel memory structures.

How to fix it

Upgrade the Linux kernel to a version containing commit 95eabb075a5902f4c0834ab1fb12dc35730c05af which applies rcu_assign_pointer in neigh_periodic_work; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by checking for rcu_assign_pointer usage around neighbor list deletion in neigh.c; run kernel selftests for neighbor table and monitor for syzbot-style race reports post-upgrade.

Typical attack path

1. Gain ability to influence neighbor cache via ARP/ND or socket operations
2. Trigger concurrent execution of neigh_periodic_work while entries are deleted
3. Observe or force torn store leading to invalid RCU pointer dereference
4. Escalate via resulting use-after-free or kernel memory corruption

How to detect it

Search kernel logs and audit trails for unexpected neighbor table warnings, RCU stalls, or use-after-free reports during high ARP/ND activity; correlate with process activity that manipulates network interfaces.

What your security team should do

• Prioritize kernel updates on all externally reachable Linux hosts within standard patch windows given low EPSS
• Enable kernel hardening features such as KASAN and lockdep in test environments to surface similar RCU issues
• Monitor upstream stable branches for related neighbor table fixes