cbcvebase.
CVE-2023-53188
published 2025-09-15

CVE-2023-53188: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine…

PriorityP419medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.10%
1.2th percentile
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "client" 3. two ovs interfaces "server" and "client" on the bridge 4. for each ovs interface a veth pair with a matching name and 32 rx and tx queues 5. move the ends of the veth pairs to the respective network namespaces 6. assign ip addresses to each of the veth ends in the namespaces (needs to be the same subnet) 7. start some http server on the server network namespace 8. test if a client in the client namespace can reach the http server when following the actions below the host has a chance of getting a cpu stuck in a infinite loop: 1. send a large amount of parallel requests to the http server (around 3000 curls should work) 2. in parallel delete the network namespace (do not delete interfaces or stop the server, just kill the namespace) there is a low chance that this will cause the below kernel cpu stuck message. If this does not happen just retry. Below there is also the output of bpftrace for the functions mentioned in the output. The series of events happening here is: 1. the network namespace is deleted calling `unregister_netdevice_many_notify` somewhere in the process 2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and then runs `synchronize_net` 3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER` 4. this is then handled by `dp_device_event` which calls `ovs_netdev_detach_dev` (if a vport is found, which is the case for the veth interface attached to ovs) 5. this removes the rx_handlers of the device but does not prevent packages to be sent to the device 6. `dp_device_event` then queues the vport deletion to work in background as a ovs_lock is needed that we do not hold in the unregistration path 7. `unregister_netdevice_many_notify` continues to call `netdev

Affected

18 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.25-1 (bookworm)linux 6.1.25-1 (bookworm)
linuxlinux——
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 9b0dd09c1ceb35950d2884848099fccc9ec9a1239b0dd09c1ceb35950d2884848099fccc9ec9a123
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 284be5db6c8d06d247ed056cfc448c4f79bbb16c284be5db6c8d06d247ed056cfc448c4f79bbb16c
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 5efcb301523baacd98a47553d4996e924923114d5efcb301523baacd98a47553d4996e924923114d
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 644b3051b06ba465bc7401bfae9b14963cbc8c1c644b3051b06ba465bc7401bfae9b14963cbc8c1c
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 56252da41426f3d01957456f13caf46ce670ea2956252da41426f3d01957456f13caf46ce670ea29
linuxlinux>= 7f8a436eaa2c3ddd8e1ff2fbca267e6275085536 < 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8066b86787fa3d97b7aefb5ac0a99a22dad2d15f8
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 4.3 < 5.4.2935.4.293
linuxlinux_kernel>= 5.11 < 5.15.1815.15.181
linuxlinux_kernel>= 5.16 < 6.1.256.1.25
linuxlinux_kernel>= 5.5 < 5.10.2375.10.237
linuxlinux_kernel>= 6.2 < 6.2.126.2.12

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.