Cloudanix VulnDB

CVE-2023-53853

None

CVSS

—

EPSS

0.2%

Published

Dec 9, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in how the Linux kernel handles certain network messages could let an attacker on the same machine cause crashes or erratic network behavior.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

Data race on nlk->cb_running in netlink subsystem where netlink_recvmsg and netlink_native_seq_show perform lockless reads while netlink_dump and __netlink_dump_start perform writes, allowing concurrent unsynchronized access that triggers KCSAN reports of inconsistent memory values.

Why it matters to the business

Kernel instability or crashes during network configuration and monitoring operations on affected Linux systems, potentially disrupting services until patched; low exploitability reduces immediate urgency but still requires remediation to eliminate undefined behavior.

How an attack unfolds

An attacker with local access crafts concurrent netlink socket operations (sendmsg and recvmsg) to hit the race window between write in __netlink_dump_start and read in netlink_recvmsg, causing memory inconsistency that may manifest as crashes or erratic behavior.

How to fix it

Upgrade to a kernel containing the READ_ONCE/WRITE_ONCE annotations for nlk->cb_running; for listed systemd packages on Ubuntu 16.04 LTS apply version 229-4ubuntu21.15 or newer.

How to confirm the fix worked

Confirm kernel source contains READ_ONCE on cb_running reads in netlink_recvmsg/netlink_native_seq_show and WRITE_ONCE on writes in netlink_dump/__netlink_dump_start; re-run KCSAN on netlink paths and verify absence of the reported data-race warning.

Typical attack path

  1. Obtain local code execution on target system
  2. Open multiple netlink sockets and issue concurrent dump and receive operations
  3. Trigger the unsynchronized access to cb_running
  4. Observe or induce kernel fault from the data race

How to detect it

Search kernel logs for KCSAN data-race reports mentioning __netlink_dump_start and netlink_recvmsg; inspect for repeated netlink socket activity preceding crashes.

What your security team should do

  • Apply the referenced kernel or systemd package update immediately on all affected Ubuntu 16.04 systems
  • Monitor for KCSAN or kernel oops reports involving netlink
  • Restrict unprivileged local access where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there. Add corresponding WRITE_ONCE() to netlink_dump() and __netlink_dump_start() syzbot reported: BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0: __netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399 netlink_dump_start include/linux/netlink.h:308 [inline] rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] sock_write_iter+0x1aa/0x230 net/socket.c:1138 call_write_iter include/linux/fs.h:1851 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x463/0x760 fs/read_write.c:584 ksys_write+0xeb/0x1a0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x42/0x50 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813ea4db59 of 1 bytes by task 28222 on cpu 1: netlink_recvmsg+0x3b4/0x730 net/netlink/af_netlink.c:2022 sock_recvmsg_nosec+0x4c/0x80 net/socket.c:1017 ____sys_recvmsg+0x2db/0x310 net/socket.c:2718 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00 -> 0x01

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 3.12.0 4.14.316

Related vulnerabilities