CVE-2023-52522

MediumCVSS 5.5/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix possible store tearing in neigh_periodic_work()

While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list.

Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing.

I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev().

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < 95eabb075a5902f4c0834ab1fb12dc35730c05af; >= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < 2ea52a2fb8e87067e26bbab4efb8872639240eb0; >= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < 147d89ee41434b97043c2dcb17a97dc151859baa; >= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < f82aac8162871e87027692b36af335a2375d4580; >= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < a75152d233370362eebedb2643592e7c883cc9fc; >= 767e97e1e0db0d0f3152cd2f3bd3403596aedbad, < 25563b581ba3a1f263a00e8c9a97f5e7363be6fd
LinuxLinux2.6.37

References

Timeline

Published
Mar 2, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-525235.5In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets With aCVE-2023-525247.8In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list neCVE-2023-525257.1In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet OnCVE-2023-525265.5In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stCVE-2023-525275.5In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() InclCVE-2023-525285.5In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzCVE-2023-525296.0In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occCVE-2023-52537.5A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may alCVE-2023-525307.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_liCVE-2023-525317.8In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, sCVE-2023-525325.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type CVE-2023-525335.3In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosu