CVE-2023-53204
published 2025-09-15CVE-2023-53204: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under…
PriorityP417medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.11%
1.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-races around user->unix_inflight.
user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.
Let's annotate the write/read accesses to user->unix_inflight.
BUG: KCSAN: data-race in unix_attach_fds / unix_inflight
write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
unix_inflight+0x157/0x180 net/unix/scm.c:66
unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
read to 0xffffffff8546f2d0 of 8 bytes by task 44814 on cpu 0:
too_many_unix_fds net/unix/scm.c:101 [inline]
unix_attach_fds+0x54/0x1e0 net/unix/scm.c:110
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.55-1 (bookworm) | linux 6.1.55-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.10.96 < 3.11 | 3.11 |
| linux | linux | >= 3.12.57 < 3.13 | 3.13 |
| linux | linux | >= 3.14.60 < 3.15 | 3.15 |
| linux | linux | >= 3.18.27 < 3.19 | 3.19 |
| linux | linux | >= 3.2.78 < 3.3 | 3.3 |
| linux | linux | >= 4.1.17 < 4.2 | 4.2 |
| linux | linux | >= 4.3.5 < 4.4 | 4.4 |
| linux | linux | >= 4.4.1 < 4.5 | 4.5 |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < df97b5ea9f3ac9308c3a633524dab382cd59d9e5 | df97b5ea9f3ac9308c3a633524dab382cd59d9e5 |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < 03d133dfbcec9d439729cc64706c7eb6d1663a24 | 03d133dfbcec9d439729cc64706c7eb6d1663a24 |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < adcf4e069358cdee8593663650ea447215a1c49e | adcf4e069358cdee8593663650ea447215a1c49e |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < b401d7e485b0a234cf8fe9a6ae99dbcd20863138 | b401d7e485b0a234cf8fe9a6ae99dbcd20863138 |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < 9151ed4b006125cba7c06c79df504340ea4e9386 | 9151ed4b006125cba7c06c79df504340ea4e9386 |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < b9cdbb38e030fc2fe97fe27b54cbb6b4fbff250f | b9cdbb38e030fc2fe97fe27b54cbb6b4fbff250f |
| linux | linux | >= 712f4aad406bb1ed67f3f98d04c044191f0ff593 < ac92f239a079678a035c0faad9089354a874aede | ac92f239a079678a035c0faad9089354a874aede |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: af_unix: Fix data-races around user->unix_inflight
vendor_redhat·2025-09-15·CVSS 4.7
CVE-2023-53204 [MEDIUM] CWE-366 kernel: af_unix: Fix data-races around user->unix_inflight
kernel: af_unix: Fix data-races around user->unix_inflight
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-races around user->unix_inflight.
user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.
Let's annotate the write/read accesses to user->unix_inflight.
BUG: KCSAN: data-race in unix_attach_fds / unix_inflight
write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
unix_inflight+0x157/0x180 net/unix/scm.c:66
unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec n
Debian
CVE-2023-53204: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fi...
vendor_debian·2023·CVSS 4.7
CVE-2023-53204 [MEDIUM] CVE-2023-53204: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fi...
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under spin_lock(unix_gc_lock), but too_many_unix_fds() reads it locklessly. Let's annotate the write/read accesses to user->unix_inflight. BUG: KCSAN: data-race in unix_attach_fds / unix_inflight write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1: unix_inflight+0x157/0x180 net/unix/scm.c:66 unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1827 [inline] unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950 unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline] unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0x148/0x160 net/socket
GHSA
GHSA-rpfp-2r63-7p7p: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-races around user->unix_inflight
ghsa_unreviewed·2025-09-15
CVE-2023-53204 [MEDIUM] CWE-362 GHSA-rpfp-2r63-7p7p: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-races around user->unix_inflight
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-races around user->unix_inflight.
user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.
Let's annotate the write/read accesses to user->unix_inflight.
BUG: KCSAN: data-race in unix_attach_fds / unix_inflight
write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
unix_inflight+0x157/0x180 net/unix/scm.c:66
unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/s
OSV
CVE-2023-53204: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight
osv·2025-09-15·CVSS 4.7
CVE-2023-53204 [MEDIUM] CVE-2023-53204: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under spin_lock(unix_gc_lock), but too_many_unix_fds() reads it locklessly. Let's annotate the write/read accesses to user->unix_inflight. BUG: KCSAN: data-race in unix_attach_fds / unix_inflight write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1: unix_inflight+0x157/0x180 net/unix/scm.c:66 unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1827 [inline] unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950 unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline] unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0x148/0x160 net/socket
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03d133dfbcec9d439729cc64706c7eb6d1663a24https://git.kernel.org/stable/c/0bc36c0650b21df36fbec8136add83936eaf0607https://git.kernel.org/stable/c/9151ed4b006125cba7c06c79df504340ea4e9386https://git.kernel.org/stable/c/ac92f239a079678a035c0faad9089354a874aedehttps://git.kernel.org/stable/c/adcf4e069358cdee8593663650ea447215a1c49ehttps://git.kernel.org/stable/c/b401d7e485b0a234cf8fe9a6ae99dbcd20863138https://git.kernel.org/stable/c/b9cdbb38e030fc2fe97fe27b54cbb6b4fbff250fhttps://git.kernel.org/stable/c/df97b5ea9f3ac9308c3a633524dab382cd59d9e5
2025-09-15
Published