CVE-2023-53825
published 2025-12-09CVE-2023-53825: In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). syzkaller found a memory leak in…
PriorityP418medium5.5
EPSS
0.25%
16.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong skb and the queue was messed up. However, we have
yet to get such a report, and only syzkaller stumbled on it. So, this
can be changed safely.
Note this does not change SOCK_SEQPACKET behaviour.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.55-1 (bookworm) | linux 6.1.55-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 21b467735b0888a8daa048f83d3b9b50fdab71ce | 21b467735b0888a8daa048f83d3b9b50fdab71ce |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < d4b8f380b0a041ee6a84fdac14127d8fe1dcad7b | d4b8f380b0a041ee6a84fdac14127d8fe1dcad7b |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 1ce8362b4ac6b8e65fd04a22ea37ec776ee1ec5b | 1ce8362b4ac6b8e65fd04a22ea37ec776ee1ec5b |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 2e18493c421428a936946c452461b8e979088f17 | 2e18493c421428a936946c452461b8e979088f17 |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 55d2e7c1ab8eaa7b62575b8a4194132795d1f9fc | 55d2e7c1ab8eaa7b62575b8a4194132795d1f9fc |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < e5b28ce127a690f3acc49a6a342e6c9442c9edd6 | e5b28ce127a690f3acc49a6a342e6c9442c9edd6 |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 992b2ac783aad360b98ed9d4686e86176a20f6f1 | 992b2ac783aad360b98ed9d4686e86176a20f6f1 |
| linux | linux | >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < a22730b1b4bf437c6bbfdeff5feddf54be4aeada | a22730b1b4bf437c6bbfdeff5feddf54be4aeada |
| linux | linux_kernel | >= 0 < 5.10.197-1 | 5.10.197-1 |
| linux | linux_kernel | >= 0 < 6.1.55-1 | 6.1.55-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 4.15.0 < 4.19.295 | 4.19.295 |
| linux | linux_kernel | >= 4.20.0 < 5.4.257 | 5.4.257 |
| linux | linux_kernel | >= 4.6.0 < 4.14.326 | 4.14.326 |
| linux | linux_kernel | >= 5.11.0 < 5.15.132 | 5.15.132 |
| linux | linux_kernel | >= 5.16.0 < 6.1.54 | 6.1.54 |
| linux | linux_kernel | >= 5.5.0 < 5.10.195 | 5.10.195 |
| linux | linux_kernel | >= 6.2.0 < 6.5.4 | 6.5.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qqwx-6fr4-mfj2: In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
ghsa_unreviewed·2025-12-09
CVE-2023-53825 GHSA-qqwx-6fr4-mfj2: In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong skb and the queue was messed up. However, we have
yet to get such a report
OSV
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
osv·2025-12-09
CVE-2023-53825 kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong skb and the queu
OSV
CVE-2023-53825: In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
osv·2025-12-09
CVE-2023-53825 CVE-2023-53825: In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720 ("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by updating kcm_tx_msg(head)->last_skb if partial data is copied so that the following sendmsg() will resume from the skb. However, we cannot know how many bytes were copied when we get the error. Thus, we could mess up the MSG_MORE queue. When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we do so for UDP by udp_flush_pending_frames(). Even without this change, when the error occurred, the following sendmsg() resumed from a wrong skb and the queue was messed up. However, we have yet to get such a report, and
Red Hat
kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
vendor_redhat·2025-12-09·CVSS 5.5
CVE-2023-53825 [MEDIUM] CWE-390 kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong skb and the qu
Debian
CVE-2023-53825: linux - In the Linux kernel, the following vulnerability has been resolved: kcm: Fix er...
vendor_debian·2023
CVE-2023-53825 CVE-2023-53825: linux - In the Linux kernel, the following vulnerability has been resolved: kcm: Fix er...
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720 ("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by updating kcm_tx_msg(head)->last_skb if partial data is copied so that the following sendmsg() will resume from the skb. However, we cannot know how many bytes were copied when we get the error. Thus, we could mess up the MSG_MORE queue. When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we do so for UDP by udp_flush_pending_frames(). Even without this change, when the error occurred, the following sendmsg() resumed from a wrong skb and the queue was messed up. However, we have yet to get such a report, and
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-53825 kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
bugzilla·2025-12-09
CVE-2023-53825 [MEDIUM] CVE-2023-53825 kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
CVE-2023-53825 kernel: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a
Wiz
CVE-2023-53825 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53825 CVE-2023-53825 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53825 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong s
https://git.kernel.org/stable/c/1ce8362b4ac6b8e65fd04a22ea37ec776ee1ec5bhttps://git.kernel.org/stable/c/21b467735b0888a8daa048f83d3b9b50fdab71cehttps://git.kernel.org/stable/c/2e18493c421428a936946c452461b8e979088f17https://git.kernel.org/stable/c/55d2e7c1ab8eaa7b62575b8a4194132795d1f9fchttps://git.kernel.org/stable/c/992b2ac783aad360b98ed9d4686e86176a20f6f1https://git.kernel.org/stable/c/a22730b1b4bf437c6bbfdeff5feddf54be4aeadahttps://git.kernel.org/stable/c/d4b8f380b0a041ee6a84fdac14127d8fe1dcad7bhttps://git.kernel.org/stable/c/e5b28ce127a690f3acc49a6a342e6c9442c9edd6
2025-12-09
Published