CVE-2023-52522

A flaw was found in the Linux kernel that allows for potential store tearing within the neigh_periodic_work() function, meaning a write operation on a value is not protected properly and could result in inconsistencies if another process or thread reads from that value before the operation is complete.

A Moderate severity flaw was found in the Linux kernel's neighbor table handling in net/core/neighbour.c, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9. When neigh_periodic_work() deletes an RCU-protected neighbor entry from a list, the list-pointer write lacks the rcu_assign_pointer()/WRITE_ONCE() annotation needed to prevent store tearing. A concurrent lockless reader using rcu_dereference() could therefore observe a partially written pointer, resulting in inconsistent neighbor table state and a potential kernel crash. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges and the impact is limited to system availability; this differs from the higher severity (8.8) assigned in the upstream CVE record. A fix is being pursued for the affected Red Hat Enterprise Linux kernel packages through the delegated maintenance process. The kernel in Fedora is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.