DF-2715
Kernel-internal MSG_FNONBLOCKING/MSG_FBLOCKING state leaks into user-visible msg_flags on every recvmsg(2) from a non-blocking socket
| Field | Value |
|---|---|
| ID | DF-2715 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-200 (API semantics) |
| File | sys/kern/uipc_syscalls.c |
| Lines | 996-1005, 1195-1196 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
kern_recvmsg() ORs MSG_FNONBLOCKING (0x20000) into *flags derived from the file's FNONBLOCK state, and sys_recvmsg() copies that flags word back into the user msghdr.msg_flags without masking the internal bits. Every recvmsg on an O_NONBLOCK socket reports msg_flags |= 0x20000. Semantics/API defect only (kernel fd state surfacing through a POSIX field userland uses for MSG_EOR/TRUNC/CTRUNC); no memory-safety impact.
Recommended fix
Mask internal flags before the msg_flags copyout:
flags &= ~(MSG_FNONBLOCKING|MSG_FBLOCKING); before the copyout at
:1195.
Timeline
- 2026-08-30 Discovered during pass-2 audit of uipc_syscalls.c (GLM 5.3).
No comments yet.