CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp()
In the Linux kernel, the following vulnerability has been resolved:
net: Drop the lock in skbmaytxtimestamp()
skbmaytxtimestamp() may acquire sock::skcallbacklock. The lock must not be taken in IRQ context, only softirq is okay. A few drivers receive the timestamp via a dedicated interrupt and complete the TX timestamp from that handler. This will lead to a deadlock if the lock is already write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will remain valid until the skb is released. The ->sksocket and ->file member will be set to NULL once the user closes the socket which may happen before the timestamp arrives. If we happen to observe the pointer while the socket is closing but before the pointer is set to NULL then we may use it because both pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READONCE() to obtain the individual pointer. Add a matching WRITEONCE() where the pointer are cleared.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The issue is relevant to Linux kernel systems using network drivers that receive transmit timestamps through a dedicated interrupt and complete TX timestamp processing in that interrupt handler. The deadlock requires skb_may_tx_timestamp() to attempt to acquire sock::sk_callback_lock in IRQ context while that lock is already write-locked on the same CPU.
What is the operational impact if the issue is triggered?
The described outcome is a deadlock in the kernel networking path. The CVSS vector rates the availability impact as high, with local access and low privileges required and no user interaction.
Are sockets that have been closed before a timestamp arrives part of the fix's considerations?
Yes. A socket can be closed before its timestamp arrives, clearing its ->sk_socket and ->file pointers; the fix avoids the lock while using READ_ONCE() for those pointers and relies on RCU freeing when a pointer is observed during closure.