Data Race Vulnerability in Linux Kernel's Networking Stack

CVE-2022-50323

What is CVE-2022-50323?

A vulnerability exists in the Linux kernel's networking stack, specifically in the skb_append_pagefrags() function. This function, used by various networking implementations, has been found to improperly sense pfmemalloc status for pages owned by user space. This can lead to a data race condition, where concurrent tasks can access and modify shared memory without appropriate synchronization. The issue has been documented by the Kernel Concurrency Sanitizer and is of concern for applications relying on reliable network communication, as it could result in undefined behavior or crashes.

References