CVE-2023-52527

In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself.

• https://git.kernel.org/stable/c/1fc793d68d50dee4782ef2e808913d5dd880bcc6Patch
• https://git.kernel.org/stable/c/559d697c5d072593d22b3e0bd8b8081108aeaf59Patch
• https://git.kernel.org/stable/c/7626b9fed53092aa2147978070e610ecb61af844Patch
• https://git.kernel.org/stable/c/96b2e1090397217839fcd6c9b6d8f5d439e705edPatch
• https://git.kernel.org/stable/c/9d4c75800f61e5d75c1659ba201b6c0c7ead3070Patch
• https://git.kernel.org/stable/c/cd1189956393bf850b2e275e37411855d3bd86bbPatch
• https://git.kernel.org/stable/c/f6a7182179c0ed788e3755ee2ed18c888ddcc33fPatch
• https://git.kernel.org/stable/c/fe80658c08e3001c80c5533cd41abfbb0e0e28fdPatch
• https://git.kernel.org/stable/c/1fc793d68d50dee4782ef2e808913d5dd880bcc6Patch
• https://git.kernel.org/stable/c/559d697c5d072593d22b3e0bd8b8081108aeaf59Patch
• https://git.kernel.org/stable/c/7626b9fed53092aa2147978070e610ecb61af844Patch
• https://git.kernel.org/stable/c/96b2e1090397217839fcd6c9b6d8f5d439e705edPatch
• https://git.kernel.org/stable/c/9d4c75800f61e5d75c1659ba201b6c0c7ead3070Patch
• https://git.kernel.org/stable/c/cd1189956393bf850b2e275e37411855d3bd86bbPatch
• https://git.kernel.org/stable/c/f6a7182179c0ed788e3755ee2ed18c888ddcc33fPatch
• https://git.kernel.org/stable/c/fe80658c08e3001c80c5533cd41abfbb0e0e28fdPatch

Published

Mar 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52521Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-52522In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52523In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52524In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52525In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2023-52526In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52528In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52529In the Linux kernel, the following vulnerability has been re…6
• CVE-2023-5253A missing authentication check in the WebSocket channel used…7.5
• CVE-2023-52530In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52531In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52532In the Linux kernel, the following vulnerability has been re…5.5