CVE-2023-52527

What it actually does

Incorrect inclusion of transport header length in packet append calculations for partially filled skbuffs in IPv4/IPv6 L2TP paths causes length mismatches and warnings in __ip6_append_data when MSG_SPLICE_PAGES or similar operations follow MSG_MORE sends.

Why it matters to the business

Network applications using L2TP sockets may trigger kernel warnings or unexpected behavior during data transmission, increasing operational overhead and risk of instability in affected Linux systems; high prevalence in kernel-dependent environments amplifies exposure across servers and devices.

How an attack unfolds

An attacker with local access crafts a sequence of socket operations on an L2TP IPv6 socket (bind, connect, send with MSG_MORE, followed by sendfile) to trigger the length miscalculation and associated warning or corruption path; no widespread in-the-wild exploitation or ransomware use reported despite public availability for over two years.

How to fix it

Upgrade the Linux kernel to the fixed commit 7626b9fed53092aa2147978070e610ecb61af844 or later stable releases that apply the transhdrlen guard only when the write queue is empty; apply vendor backports where available and verify via kernel build or package update.

How to confirm the fix worked

Confirm kernel source contains the updated l2tp_ip6_sendmsg logic checking write queue emptiness before adding transhdrlen; monitor for absence of the __ip6_append_data warning after applying the change and test with the reported send/sendfile reproduction sequence.

Typical attack path

1. Identify or create an L2TP IPv6 socket
2. Perform initial send with MSG_MORE to partially fill the write queue
3. Append data via sendfile or MSG_SPLICE_PAGES to exceed expected copy length
4. Trigger kernel warning or memory accounting error in __ip{,6}_append_data

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact warning string from __ip6_append_data.isra.0; inspect application logs for L2TP socket usage patterns matching the send(MSG_MORE) followed by sendfile sequence; correlate with process activity involving L2TP sockets.

• WARNING: CPU:.*at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0
• l2tp_ip6_sendmsg
• send.*MSG_MORE.*sendfile.*L2TP

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all production systems
• Review L2TP and IPv6 socket usage in applications for potential exposure
• Enable kernel panic_on_warn or enhanced logging to surface related issues
• Monitor EPSS and threat intel for any future exploitation spikes