---
id: CVE-2023-53109
title: 'net: tunnels: annotate lockless accesses to dev->needed_headroom'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: tunnels: annotate lockless accesses to dev->needed_headroom

  IP tunnels can apparently update dev->needed_headroom
  in their xmit path.

  This patch takes care of th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    8e206f66d824b3b28a7f9ee1366dfc79a937bb46
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    51f3bd3765bc5ca4583af07a00833da00d2ace1d
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    5aaab217c8f5387b9c5fff9e940d80f135e04366
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    be59b87ee4aed81db7c10e44f603866a0ac3ca5d
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    e0a557fc1daf5c1086e47150a4571aebadbb62be
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    a69b72b57b7d269e833e520ba7500d556e8189b6
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    9b86a8702b042ee4e15d2d46375be873a6a8834f
  - >-
    Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 <
    4b397c06cb987935b1b097336532aa6b4210e091
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:17:30.741707Z'
published: '2025-05-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:01.653Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53109'
references:
  - url: 'https://git.kernel.org/stable/c/8e206f66d824b3b28a7f9ee1366dfc79a937bb46'
  - url: 'https://git.kernel.org/stable/c/51f3bd3765bc5ca4583af07a00833da00d2ace1d'
  - url: 'https://git.kernel.org/stable/c/5aaab217c8f5387b9c5fff9e940d80f135e04366'
  - url: 'https://git.kernel.org/stable/c/be59b87ee4aed81db7c10e44f603866a0ac3ca5d'
  - url: 'https://git.kernel.org/stable/c/e0a557fc1daf5c1086e47150a4571aebadbb62be'
  - url: 'https://git.kernel.org/stable/c/a69b72b57b7d269e833e520ba7500d556e8189b6'
  - url: 'https://git.kernel.org/stable/c/9b86a8702b042ee4e15d2d46375be873a6a8834f'
  - url: 'https://git.kernel.org/stable/c/4b397c06cb987935b1b097336532aa6b4210e091'
tags:
  - cve.org
epss: 0.00202
epssPercentile: 0.10259
ingestedAt: '2026-11-05T22:38:31.772Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: tunnels: annotate lockless accesses to dev->needed_headroom

IP tunnels can apparently update dev->needed_headroom
in their xmit path.

This patch takes care of three tunnels xmit, and also the
core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA()
helpers.

More changes might be needed for completeness.

BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit

read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1:
ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/i
---truncated---

## Affected

- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < 8e206f66d824b3b28a7f9ee1366dfc79a937bb46`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < 51f3bd3765bc5ca4583af07a00833da00d2ace1d`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < 5aaab217c8f5387b9c5fff9e940d80f135e04366`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < be59b87ee4aed81db7c10e44f603866a0ac3ca5d`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < e0a557fc1daf5c1086e47150a4571aebadbb62be`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < a69b72b57b7d269e833e520ba7500d556e8189b6`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < 9b86a8702b042ee4e15d2d46375be873a6a8834f`
- `Linux >= 8eb30be0352d09165e94a41fef1c7b994dca0714 < 4b397c06cb987935b1b097336532aa6b4210e091`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.