CVE-2023-53831
kernel: net: read sk->sk_family once in sk_mc_loop()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 9, 2025
Updated · June 30, 2026
Description
A data race was found in the Linux kernel's networking stack. The sk_mc_loop() function reads sk->sk_family without proper synchronization while another thread may be changing it via IPV6_ADDRFORM socket option. This race can cause the function to take an unexpected code path, triggering a WARN_ON_ONCE or potentially leading to undefined behavior.
Statement
This race condition was identified through fuzzing and requires concurrent socket operations with specific timing. The primary observable impact is kernel warnings rather than exploitable memory corruption.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-820 · Missing Synchronization