Linux CVE-2026-23302

The vulnerability exists in the Linux kernel's socket implementation where the sk->sk_data_ready and sk->sk_write_space function pointers are modified by the skmsg subsystem (Socket Message handling) and potentially other kernel components without proper atomic or synchronization primitives. These pointers define callbacks that are invoked when data is ready or socket write space becomes available. The root cause is a CWE-366 (Race Condition) vulnerability where multiple CPUs can concurrently read and write these pointers without READ_ONCE() or WRITE_ONCE() compiler barriers, allowing the compiler to perform unsafe optimizations or cache values across potential modification boundaries. The fix involves annotating all accesses to these fields with READ_ONCE() and WRITE_ONCE() macros to ensure the kernel memory model treats each access as volatile and prevents compiler-level optimizations that could lead to stale or inconsistent reads of the callback pointers across the UDP, TCP, and AF_UNIX protocol families.