Description
In the Linux kernel, the following vulnerability has been resolved:
netlink: annotate lockless accesses to nlk->max_recvmsg_len
syzbot reported a data-race in data-race in netlink_recvmsg() [1]
Indeed, netlink_recvmsg() can be run concurrently,
and netlink_dump() also needs protection.
[1]
BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg
read to 0xffff888141840b38 of 8 bytes by task 23057 on cpu 0:
netlink_recvmsg+0xea/0x730 net/netlink/af_netlink.c:1988
sock_recvmsg_nosec net/socket.c:1017 [inline]
sock_recvmsg net/socket.c:1038 [inline]
__sys_recvfrom+0x1ee/0x2e0 net/socket.c:2194
__do_sys_recvfrom net/socket.c:2212 [inline]
__se_sys_recvfrom net/socket.c:2208 [inline]
__x64_sys_recvfrom+0x78/0x90 net/socket.c:2208
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
write to 0xffff888141840b38 of 8 bytes by task 23037 on cpu 1:
netlink_recvmsg+0x114/0x730 net/netlink/af_netlink.c:1989
sock_recvmsg_nosec net/socket.c:1017 [inline]
sock_recvmsg net/socket.c:1038 [inline]
____sys_recvmsg+0x156/0x310 net/socket.c:2720
___sys_recvmsg net/socket.c:2762 [inline]
do_recvmmsg+0x2e5/0x710 net/socket.c:2856
__sys_recvmmsg net/socket.c:2935 [inline]
__do_sys_recvmmsg net/socket.c:2958 [inline]
__se_sys_recvmmsg net/socket.c:2951 [inline]
__x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x0000000000000000 -> 0x0000000000001000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 23037 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00195-g5a57b48fdfcb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.15 | 5.10.218 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.1.25-1 | — |
| Debian 13 | linux | 6.1.25-1 | — |
| Debian 12 | linux | 6.1.25-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1050.52 | — |
| Ubuntu 24.04 LTS | linux-riscv +10 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-118.128 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1067.73 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1070.79 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1070.79.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1066.74 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1064.70 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1050.57 | — |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1060.63 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1062.68 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1064.69 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1062.63 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1027.27 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1015.15 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1065.71 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1035.39 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1067.73~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1070.79~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1066.74~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-118.128~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1060.63~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1062.68~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1027.27~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1065.71~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1063.67~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1060.62 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1068.76 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1067.73+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1070.79+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-118.128+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1066.74+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +10 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.25-37.47 | 1.0-0.amzn2023 | ALAS2023-2023-169 |
| Amazon Linux 2023 | perf +12 | 6.1.25-37.47.amzn2023 | ALAS2023-2023-169 |
Advisories 2
- WID-SEC-2025-2765 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2023-169 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 8, 2026
References
- https://git.kernel.org/stable/c/05c9e3fc93b02d18c3ab258d43350a6d44b40bbd
- https://git.kernel.org/stable/c/7cff4103be7c402ecc3e7bf8f95a64089e3c91b8
- https://git.kernel.org/stable/c/e3bcf2a77060bea4d8d09cb09d92c7056f07df5a
- https://git.kernel.org/stable/c/fc4ba13013ddaea8b11b88fd52b35449e2d9cf85
- https://git.kernel.org/stable/c/a1865f2e7d10dde00d35a2122b38d2e469ae67ed