CVE-2023-52881
A flaw in the Linux kernel’s TCP stack allowed the system to accept ACK packets for data that had never been sent, potentially enabling spoofed traffic. The patch tightens ACK validation so that only ACKs within the valid window are accepted. This protects against certain TCP-based attacks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.7 and earlier versions that do not include the patch; any system running those kernels.
Real-world impact
An attacker could send forged ACK packets that the kernel would accept, allowing them to spoof traffic or disrupt connections.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, with no authentication or user interaction required. The flaw allows an attacker to manipulate TCP state, leading to potential data tampering or denial of service.
What to do about it
- 01Check the current kernel version with `uname -r`.
- 02Update the system to a kernel version that includes the patch (e.g., 6.7 or later).
- 03Reboot the system to load the updated kernel.
NVD description
Timeline
- May 29, 2024 · May 29, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/008b807fe487e0b15a…patch
- git.kernel.org/stable/c/0d4e0afdd6658cd21d…patch
- git.kernel.org/stable/c/2087d53a66e97a5eb5…patch
- git.kernel.org/stable/c/3d501dd326fb1c73f1…patch
- git.kernel.org/stable/c/458f07ffeccd17f999…patch
- git.kernel.org/stable/c/69eae75ca5255e8766…patch
- git.kernel.org/stable/c/7ffff0cc929fdfc62a…patch
- git.kernel.org/stable/c/b17a886ed29f3b70b7…patch