{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2023-53645",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-10-07T15:16:59.659Z",
        "datePublished": "2025-10-07T15:19:43.738Z",
        "dateUpdated": "2026-08-05T09:15:20.081Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T09:15:20.081Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make bpf_refcount_acquire fallible for non-owning refs\n\nThis patch fixes an incorrect assumption made in the original\nbpf_refcount series [0], specifically that the BPF program calling\nbpf_refcount_acquire on some node can always guarantee that the node is\nalive. In that series, the patch adding failure behavior to rbtree_add\nand list_push_{front, back} breaks this assumption for non-owning\nreferences.\n\nConsider the following program:\n\n  n = bpf_kptr_xchg(&mapval, NULL);\n  /* skip error checking */\n\n  bpf_spin_lock(&l);\n  if(bpf_rbtree_add(&t, &n->rb, less)) {\n    bpf_refcount_acquire(n);\n    /* Failed to add, do something else with the node */\n  }\n  bpf_spin_unlock(&l);\n\nIt's incorrect to assume that bpf_refcount_acquire will always succeed in this\nscenario. bpf_refcount_acquire is being called in a critical section\nhere, but the lock being held is associated with rbtree t, which isn't\nnecessarily the lock associated with the tree that the node is already\nin. So after bpf_rbtree_add fails to add the node and calls bpf_obj_drop\nin it, the program has no ownership of the node's lifetime. Therefore\nthe node's refcount can be decr'd to 0 at any time after the failing\nrbtree_add. If this happens before the refcount_acquire above, the node\nmight be free'd, and regardless refcount_acquire will be incrementing a\n0 refcount.\n\nLater patches in the series exercise this scenario, resulting in the\nexpected complaint from the kernel (without this patch's changes):\n\n  refcount_t: addition on 0; use-after-free.\n  WARNING: CPU: 1 PID: 207 at lib/refcount.c:25 refcount_warn_saturate+0xbc/0x110\n  Modules linked in: bpf_testmod(O)\n  CPU: 1 PID: 207 Comm: test_progs Tainted: G           O       6.3.0-rc7-02231-g723de1a718a2-dirty #371\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:refcount_warn_saturate+0xbc/0x110\n  Code: 6f 64 f6 02 01 e8 84 a3 5c ff 0f 0b eb 9d 80 3d 5e 64 f6 02 00 75 94 48 c7 c7 e0 13 d2 82 c6 05 4e 64 f6 02 01 e8 64 a3 5c ff <0f> 0b e9 7a ff ff ff 80 3d 38 64 f6 02 00 0f 85 6d ff ff ff 48 c7\n  RSP: 0018:ffff88810b9179b0 EFLAGS: 00010082\n  RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000\n  RDX: 0000000000000202 RSI: 0000000000000008 RDI: ffffffff857c3680\n  RBP: ffff88810027d3c0 R08: ffffffff8125f2a4 R09: ffff88810b9176e7\n  R10: ffffed1021722edc R11: 746e756f63666572 R12: ffff88810027d388\n  R13: ffff88810027d3c0 R14: ffffc900005fe030 R15: ffffc900005fe048\n  FS:  00007fee0584a700(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00005634a96f6c58 CR3: 0000000108ce9002 CR4: 0000000000770ee0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   <TASK>\n   bpf_refcount_acquire_impl+0xb5/0xc0\n\n  (rest of output snipped)\n\nThe patch addresses this by changing bpf_refcount_acquire_impl to use\nrefcount_inc_not_zero instead of refcount_inc and marking\nbpf_refcount_acquire KF_RET_NULL.\n\nFor owning references, though, we know the above scenario is not possible\nand thus that bpf_refcount_acquire will always succeed. Some verifier\nbookkeeping is added to track \"is input owning ref?\" for bpf_refcount_acquire\ncalls and return false from is_kfunc_ret_null for bpf_refcount_acquire on\nowning refs despite it being marked KF_RET_NULL.\n\nExisting selftests using bpf_refcount_acquire are modified where\nnecessary to NULL-check its return value.\n\n  [0]: https://lore.kernel.org/bpf/20230415201811.343116-1-davemarchevsky@fb.com/"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The vulnerability is reached by loading and running an attacker-authored BPF program via the bpf() syscall; the affected kfuncs are registered only for tracing, sched_cls and struct_ops program types. No remote or adjacent network path reaches bpf_refcount_acquire_impl().\nAC:L - The attacker writes both sides of the race — one program instance performs the failing rbtree_add plus refcount_acquire while another removes and drops the node — and can trigger them concurrently on many CPUs via packet RX or fentry hits. The upstream selftests reproduce the refcount-on-zero use-after-free deterministically enough to be caught by the kernel.\nPR:L - A local user with BPF program-load access (CAP_BPF plus CAP_NET_ADMIN/CAP_PERFMON, routinely granted to containers, network agents and observability daemons) can load the offending program; no full root in the init namespace is needed. This matches how the kernel CNA scores comparable BPF verifier/kfunc soundness defects.\nUI:N - The attacker loads and triggers the BPF program entirely on their own; no victim action, mount, or file open is involved.\nS:U - The corruption stays within the kernel's own memory and security authority, giving local privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The dangling pointer is returned as a fully-typed owning reference, so the program can read every field of a freed node after that memory is reallocated to other bpf_mem_alloc/slab objects, yielding arbitrary kernel memory disclosure.\nI:H - The same owning reference permits attacker-controlled writes at chosen offsets into freed-and-reused memory, plus double-free via bpf_obj_drop and re-linking of the stale node into lists/rbtrees — a classic type-confusion/arbitrary-write path to code execution.\nA:H - The bug directly produces a refcount_warn_saturate() WARN (\"addition on 0; use-after-free\"), which panics on panic_on_warn systems, and the resulting use-after-free readily corrupts kernel memory into an oops or panic."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/bpf/helpers.c",
                        "kernel/bpf/verifier.c",
                        "tools/testing/selftests/bpf/progs/refcounted_kptr.c",
                        "tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c"
                    ],
                    "versions": [
                        {
                            "version": "d2dcc67df910dd85253a701b6a5b747f955d28f5",
                            "lessThan": "d906d1b940b9dbf0a3e821d6b32a51c369273d91",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d2dcc67df910dd85253a701b6a5b747f955d28f5",
                            "lessThan": "7793fc3babe9fea908e57f7c187ea819f9fd7e95",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/bpf/helpers.c",
                        "kernel/bpf/verifier.c",
                        "tools/testing/selftests/bpf/progs/refcounted_kptr.c",
                        "tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c"
                    ],
                    "versions": [
                        {
                            "version": "6.4",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.4",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.4.4",
                            "lessThanOrEqual": "6.4.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.5",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.4.4"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.5"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/d906d1b940b9dbf0a3e821d6b32a51c369273d91"
                },
                {
                    "url": "https://git.kernel.org/stable/c/7793fc3babe9fea908e57f7c187ea819f9fd7e95"
                }
            ],
            "title": "bpf: Make bpf_refcount_acquire fallible for non-owning refs",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}