CVE-2023-53338

HIGH EPSS 9.3%
Published Sep 17, 20259mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Sep 17, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
9.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥4.10  –  <5.4.257
linuxlinux_kernel*≥5.5  –  <5.10.195
linuxlinux_kernel*≥5.11  –  <5.15.132
linuxlinux_kernel*≥5.16  –  <6.1.53
linuxlinux_kernel*≥6.2  –  <6.4.16
linuxlinux_kernel*≥6.5  –  <6.5.3

References 7

  • git.kernel.org https://git.kernel.org/stable/c/065d5f17096ec9161180e2c890afdff4dc6125f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/29b22badb7a84b783e3a4fffca16f7768fb31205
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/65583f9e070db7bece20710cfa2e3daeb0b831d9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/67f8f2bae8e7ac72e09def2b667e44704c4d1ee1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a97f221651fcdc891166e9bc270e3d9bfa5a0080
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d68c17402442f5f494a2c3ebde5cb82f6aa9160a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e3f647e4b642f9f6d32795a16f92c116c138d2af
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/065d5f17096ec9161180e2c890afdff4dc6125f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/29b22badb7a84b783e3a4fffca16f7768fb31205
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/65583f9e070db7bece20710cfa2e3daeb0b831d9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/67f8f2bae8e7ac72e09def2b667e44704c4d1ee1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a97f221651fcdc891166e9bc270e3d9bfa5a0080
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d68c17402442f5f494a2c3ebde5cb82f6aa9160a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e3f647e4b642f9f6d32795a16f92c116c138d2af
    Patch