{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53426", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-17T14:54:09.743Z", "datePublished": "2025-09-18T16:04:08.192Z", "dateUpdated": "2026-08-05T09:14:03.906Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:03.906Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix xsk_diag use-after-free error during socket cleanup\n\nFix a use-after-free error that is possible if the xsk_diag interface\nis used after the socket has been unbound from the device. This can\nhappen either due to the socket being closed or the device\ndisappearing. In the early days of AF_XDP, the way we tested that a\nsocket was not bound to a device was to simply check if the netdevice\npointer in the xsk socket structure was NULL. Later, a better system\nwas introduced by having an explicit state variable in the xsk socket\nstruct. For example, the state of a socket that is on the way to being\nclosed and has been unbound from the device is XSK_UNBOUND.\n\nThe commit in the Fixes tag below deleted the old way of signalling\nthat a socket is unbound, setting dev to NULL. This in the belief that\nall code using the old way had been exterminated. That was\nunfortunately not true as the xsk diagnostics code was still using the\nold way and thus does not work as intended when a socket is going\ndown. Fix this by introducing a test against the state variable. If\nthe socket is in the state XSK_UNBOUND, simply abort the diagnostic's\nnetlink operation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local syscalls: create/bind an AF_XDP socket, destroy the bound netdev via rtnetlink, then dump via NETLINK_SOCK_DIAG. This is not reachable from remote network packet processing.\nAC:L - No uncontrolled race is required; after NETDEV_UNREGISTER sets XSK_UNBOUND and drops the final netdev ref without clearing xs->dev, a subsequent xsk_diag dump reliably dereferences the freed net_device. The attacker fully controls this sequence.\nPR:L - AF_XDP creation needs only ns_capable(CAP_NET_RAW), and creating/deleting a veth needs CAP_NET_ADMIN in the network namespace; both are obtainable by an unprivileged user via user namespaces. sock_diag dumps to the kernel do not require root.\nUI:N - The attacker creates the AF_XDP socket, removes the device, and issues the diag dump entirely on their own with no victim action.\nS:U - Impact is confined to the local kernel's authority (memory corruption / privilege escalation within the host kernel); it does not cross a VM, IOMMU, or other security boundary.\nC:H - The bug is a use-after-free read of a freed net_device (xs->dev->ifindex) whose contents can be controlled via heap reuse, enabling arbitrary kernel memory disclosure per UAF scoring guidance.\nI:H - UAF of a large kmalloc net_device object enables heap spraying and write primitives for control-flow hijacking, so integrity impact is High even though the immediate fault is a read.\nA:H - The UAF produces kernel oops/KASAN faults and can panic the system when the stale net_device pointer is accessed during diag dump." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/xdp/xsk_diag.c" ], "versions": [ { "version": "ad7219cd8751bd258b9d1e69ae0654ec00f71875", "lessThan": "5979985f2d6b565b6cf0f79a62670a2855c0e96c", "status": "affected", "versionType": "git" }, { "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21", "lessThan": "6436973164ea5506a495f39e56be5aea375e7832", "status": "affected", "versionType": "git" }, { "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21", "lessThan": "595931912357fa3507e522a7f8a0a76e423c23e4", "status": "affected", "versionType": "git" }, { "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21", "lessThan": "3e019d8a05a38abb5c85d4f1e85fda964610aa14", "status": "affected", "versionType": "git" }, { "version": "d1579253ffce39986e7a6ab757ac93b2680a665f", "status": "affected", "versionType": "git" }, { "version": "8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9", "status": "affected", "versionType": "git" }, { "version": "5.15.33", "lessThan": "5.15.132", "status": "affected", "versionType": "semver" }, { "version": "5.16.19", "lessThan": "5.17", "status": "affected", "versionType": "semver" }, { "version": "5.17.2", "lessThan": "5.18", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/xdp/xsk_diag.c" ], "versions": [ { "version": "5.18", "status": "affected" }, { "version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.132", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.54", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.4", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.33", "versionEndExcluding": "5.15.132" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.5.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5979985f2d6b565b6cf0f79a62670a2855c0e96c" }, { "url": "https://git.kernel.org/stable/c/6436973164ea5506a495f39e56be5aea375e7832" }, { "url": "https://git.kernel.org/stable/c/595931912357fa3507e522a7f8a0a76e423c23e4" }, { "url": "https://git.kernel.org/stable/c/3e019d8a05a38abb5c85d4f1e85fda964610aa14" } ], "title": "xsk: Fix xsk_diag use-after-free error during socket cleanup", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2023-53426", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T19:13:38.758691Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:23:08.755Z" } } ] } }