Executive brief
The Linux kernel's netlink socket implementation contains a data race condition in the handling of maximum receive message length. This race can occur when multiple threads concurrently access the same netlink socket, potentially leading to inconsistent state or denial of service. Systems running affected kernel versions may experience socket-related failures or crashes under concurrent workloads.
Technical details
The vulnerability is a data-race (KCSAN-detected concurrent read/write without synchronization) in the netlink_recvmsg() function at net/netlink/af_netlink.c, where the nlk->max_recvmsg_len field is accessed without proper locking. The vulnerable code path can be triggered by concurrent calls to netlink_recvmsg() on the same socket or by simultaneous calls to netlink_dump(). An attacker with local access to create netlink sockets can trigger the race condition via concurrent recvmsg/recvmmsg syscalls to cause data inconsistency, potentially leading to denial of service. The fix involves annotating lockless accesses or adding proper synchronization primitives around the affected field.
Affected products
- Linux Linux kernel 6.3.0 and potentially earlier versions
Timeline
- 2025-12-09: disclosed: Vulnerability publicly disclosed
- 2023-04: other: Issue reported by syzbot in Linux 6.3.0-rc4