Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can crash kernels with hardened user-copy protection when an application reads certain TCP error-queue data. The result is primarily an availability risk: an affected system may panic or terminate critical workloads. The supplied evidence does not establish data theft, code execution, or active exploitation.
Executive priority
Treat this as a targeted availability issue, not a demonstrated system-compromise emergency. Patch affected production kernels through normal expedited maintenance, prioritizing critical network services and embedded appliances where a kernel panic would cause material downtime. Escalate urgency if vendors confirm remote reachability or exploitation.
Technical view
Cloned TCP socket buffers from skbuff_fclone_cache lack the user-copy region defined for skbuff_head_cache. When such a buffer reaches sk_error_queue, recvmsg(MSG_ERRQUEUE) can make sock_recv_errqueue() pass skb->cb data to put_cmsg(), triggering CONFIG_HARDENED_USERCOPY and a kernel BUG. The fix copies through a local stack buffer.
Likely exposure
Exposure requires an affected Linux kernel, CONFIG_HARDENED_USERCOPY, and the documented TCP buffer cloning, timestamp error-queue, and userspace read conditions. The bundle identifies affected versions from 4.16 through listed stable releases ending at 6.19, but does not provide reliable distribution-package mappings or complete version ranges.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation. It documents a reproducible kernel panic, indicating denial-of-service potential when the required networking path is reachable. It does not establish remote triggerability, required privileges, public weaponization, or consequences beyond the demonstrated crash.
Researcher notes
The failure is a hardened-usercopy whitelist mismatch for skb2->cb inside skbuff_fclones. The documented offset falls within sock_exterr_skb.ee, and the correction uses a stack bounce buffer before put_cmsg(). Exact introduction and fixed-version boundaries are unclear from the supplied version list; validate against each stable commit and downstream backports.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fix.
- Check distribution and appliance advisories for exact corrected package versions.
- Prioritize exposed, availability-critical systems using hardened user-copy kernels.
- Apply vendor-recommended temporary mitigations if immediate kernel replacement is unavailable.
Validation and detection
- Record running kernel versions and confirm CONFIG_HARDENED_USERCOPY status.
- Map vendor kernel packages to the referenced stable commits.
- Search kernel logs for usercopy violations involving skbuff_fclone_cache and sock_recv_errqueue.
- Verify updated systems boot the corrected kernel, not an older installed image.
- Test affected timestamping and error-queue workloads safely after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22977 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/88dd6be7ebb3153b662c2cebcb06e032a92857f5CVE reference, Linux
- https://git.kernel.org/stable/c/c655d2167bf014d4c61b4faeca59b60ff9b9f6b1CVE reference, Linux
- https://git.kernel.org/stable/c/8c6901aa29626e35045130bac09b75f791acca85CVE reference, Linux
- https://git.kernel.org/stable/c/582a5e922a9652fcbb7d0165c95d5b20aa37575dCVE reference, Linux
- https://git.kernel.org/stable/c/005671c60fcf1dbdb8bddf12a62568fd5e4ec391CVE reference, Linux
- https://git.kernel.org/stable/c/e00b169eaac5f7cdbf710c354c8fa76d02009115CVE reference, Linux
- https://git.kernel.org/stable/c/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.