CVE-2023-54006 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-race around unix_tot_inflight.
unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly.
Let's use READ_ONCE() for unix_tot_inflight.
Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress")
BUG: KCSAN: data-race in unix_inflight / unix_release_sock
write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1: unix_inflight+0x130/0x180 net/unix/scm.c:64 unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1832 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955 sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2493 ___sys_sendmsg+0xc6/0x140 net/socket.c:2547 __sys_sendmsg+0x94/0x140 net/socket.c:2576 __do_sys_sendmsg net/socket.c:2585 [inline]
__se_sys_sendmsg net/socket.c:2583 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2583 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0: unix_release_sock+0x608/0x910 net/unix/af_unix.c:671 unix_release+0x59/0x80 net/unix/af_unix.c:1058 __sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1385 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/30/2026
The vulnerability described in CVE-2023-54006 represents a critical data race condition within the Linux kernel's Unix domain socket implementation, specifically affecting the `unix_tot_inflight` variable. This issue arises from inconsistent synchronization practices between writer and reader threads, creating a potential for unpredictable behavior and system instability. The kernel's concurrency sanitizer identified this race during testing, highlighting the fundamental flaw in how the `unix_tot_inflight` variable is accessed across different execution contexts. The variable in question tracks the total number of inflight messages within the Unix socket subsystem and is modified under the protection of `spin_lock(unix_gc_lock)` but read without any synchronization mechanism in `unix_release_sock()`. This discrepancy creates a classic race condition where a reader might observe an inconsistent or partially updated value, potentially leading to incorrect accounting of socket resources and compromised system integrity.
The technical flaw manifests through the specific interaction between two kernel functions that operate on the same shared data structure. The `unix_inflight` function, which serves as the writer, updates `unix_tot_inflight` while holding the `unix_gc_lock` spinlock, ensuring exclusive access during modifications. However, the `unix_release_sock` function, acting as the reader, accesses `unix_tot_inflight` without any locking primitives, relying on a lockless read operation. This pattern violates fundamental concurrency principles and is explicitly flagged by the Kernel Concurrency Sanitizer as a data-race condition. The race condition occurs when a writer thread modifies the variable while a reader thread attempts to access it, potentially causing the reader to observe a corrupted or intermediate state. The reported addresses and function call traces demonstrate that this race can occur during socket operations, particularly when sending messages through Unix domain sockets, making it a critical concern for kernel stability and security.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially compromise system security and reliability. When a data race occurs in kernel space, it can lead to memory corruption, incorrect resource accounting, and in severe cases, privilege escalation or denial of service conditions. The Unix domain socket mechanism is widely used across Linux systems for inter-process communication, making this vulnerability particularly dangerous as it affects a core networking component. Attackers could potentially exploit this race condition to manipulate socket resource tracking, leading to resource exhaustion or incorrect behavior in applications relying on Unix sockets. The vulnerability also represents a failure in maintaining atomicity and consistency in kernel data structures, which are fundamental requirements for secure and reliable system operation. This type of race condition can be particularly challenging to detect and exploit, as it often manifests only under specific timing conditions or under heavy system load, making it a stealthy but serious threat to system integrity.
Mitigation of this vulnerability requires implementing proper memory access semantics for the shared variable by utilizing the `READ_ONCE()` macro as suggested in the fix. This approach ensures that readers observe consistent values even when not protected by explicit locks, preventing the data race from occurring. The fix aligns with established kernel coding practices and security standards, addressing the specific concurrency issue identified in the Linux kernel's Unix socket implementation. System administrators should immediately apply the relevant kernel updates containing this fix to protect against potential exploitation. The solution also reinforces the broader principle of proper synchronization in concurrent systems, as outlined in CWE-362 which specifically addresses race conditions in software concurrency. Additionally, this vulnerability demonstrates the importance of comprehensive testing with tools like KCSAN, which are designed to detect such subtle concurrency issues in kernel code. Organizations implementing security monitoring should also consider the implications of this type of race condition on their security posture, as it represents a potential vector for privilege escalation or resource manipulation attacks that could affect system availability and data integrity.