CVE-2023-53839

What it actually does

Data race on dp->dccps_mss_cache in dccp_sendmsg() and do_dccp_getsockopt() allows concurrent unsynchronized read and write of the MSS cache value, potentially leading to inconsistent socket state or use of stale values after the socket lock is acquired.

Why it matters to the business

Systems relying on the DCCP protocol may experience unpredictable network behavior or kernel instability; the issue affects a narrow subset of Linux deployments but requires kernel updates to eliminate the race.

How an attack unfolds

An attacker with local access or the ability to trigger concurrent DCCP socket operations would race dccp_sendmsg() reads against updates to the cache; the race is resolved by adding READ_ONCE/WRITE_ONCE annotations and re-checking the value under lock, so exploitation would require bypassing those protections on an unpatched kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 162fa1e3cfb62aa780d7c40c8cccb6c2f8bef7c1 which adds the required READ_ONCE/WRITE_ONCE annotations and re-check logic.

How to confirm the fix worked

Inspect kernel source for the presence of READ_ONCE on dp->dccps_mss_cache in dccp_sendmsg and do_dccp_getsockopt, or verify the running kernel includes commit 162fa1e3cfb62aa780d7c40c8cccb6c2f8bef7c1.

Typical attack path

1. Locate or create processes that open and use DCCP sockets concurrently
2. Trigger dccp_sendmsg() or getsockopt calls in parallel with cache updates
3. Observe inconsistent MSS values leading to malformed packets or kernel faults

How to detect it

Search kernel build logs or source trees for the absence of READ_ONCE/WRITE_ONCE around dccps_mss_cache; on running systems, review audit logs for unusual DCCP socket activity or crashes referencing dccp_sendmsg.

What your security team should do

• Apply the referenced kernel commit or later stable release on all systems that build or run DCCP-enabled kernels
• Disable DCCP protocol support via kernel configuration if the feature is unused
• Monitor EPSS and KEV status for any future increase in exploit activity