Linux kernel arm64: negative length in IP checksum code causes out-of-bounds read

CVSS 7.1CVE-2023-53726Kernel, userspace & hypervisorcurated

Impact

On arm64, do_csum() guarded only against zero-length input, so a negative length produced an undefined shift and a slab out-of-bounds read, reported by syzkaller through the UDP GSO segmentation path reached from a raw AF_PACKET send. The likely outcome is a kernel crash on the host, taking every workload on the node with it. This matters only on arm64 control-plane and Grace-class GPU hosts - x86 nodes do not run this code - and reaching it needs local socket access with the privilege to send on a packet socket, not a remote packet.

Who can reach it

Local user on an arm64 host with the ability to open an AF_PACKET socket (typically CAP_NET_RAW) or otherwise drive the UDP GSO path. Not remotely reachable per the record.

What to do

Update to a stable arm64 kernel carrying the extended early return (commits in the record, e.g. ba0b46166b8e) via your distribution and reboot the arm64 nodes. Nothing to flash and no GPU-side change; schedule it with your regular kernel reboots. Restricting CAP_NET_RAW in tenant containers reduces who can reach the path in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53726 https://git.kernel.org/stable/c/ba0b46166b8e547024d02345a68b747841931ad2 https://git.kernel.org/stable/c/5a85727239a23de1cc8d93985f1056308128f3e2

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.