CVE-2023-53136

af_unix: fix struct pid leaks in OOB support

HIGH
7.1
CVSS Score
Published: May 2, 2025 at 03:56 PM UTC
Updated: June 17, 2026 at 06:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or consume_skb() would leak this reference. In this fix, I chose to fully support scm even for the OOB message. [1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff812ae26a>] alloc_pid+0x6a/0x560 kernel/pid.c:180 [<ffffffff812718df>] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [<ffffffff81272b37>] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [<ffffffff812730cc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [<ffffffff849ad699>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff849ad699>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.15 ≤ v < 5.15.1035.15 ≤ v < 6.1.205.15 ≤ v < 6.2.75.15 ≤ v < 6.35.16 ≤ v < 6.1.206.2 ≤ v < 6.2.7314001f0bf927015e459c9d387d62a231fe93af35.156.3 rc1
Vendor states this is fixed in 2aab4b96900272885bc157f8b236abf1cdc02e08 (fixed)
Vendor states this is fixed in a59d6306263c38e5c0592ea4451ca26a0778c947 (fixed)
Vendor states this is fixed in ac1968ac399205fda9ee3b18f7de7416cb3a5d0d (fixed)
Vendor states this is fixed in f3969427fb06a2c3cd6efd7faab63505cfa76e76 (fixed)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 5.15.103 (unaffected)
Vendor states this is fixed in 6.1.20 (unaffected)
Vendor states this is fixed in 6.2.7 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2aab4b96900272885bc157f8b236abf1cdc02e08
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a59d6306263c38e5c0592ea4451ca26a0778c947
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ac1968ac399205fda9ee3b18f7de7416cb3a5d0d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f3969427fb06a2c3cd6efd7faab63505cfa76e76

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card