CVE-2023-53189
published 2025-09-15CVE-2023-53189: In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer()…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.15%
5.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconf_mod_rs_timer(), reference idev depends on whether
rs_timer is not pending. Then modify rs_timer timeout.
There is a time gap in [1], during which if the pending rs_timer
becomes not pending. It will miss to hold idev, but the rs_timer
is activated. Thus rs_timer callback function addrconf_rs_timer()
will be executed and put idev later without holding idev. A refcount
underflow issue for idev can be caused by this.
if (!timer_pending(&idev->rs_timer))
in6_dev_hold(idev);
rs_timer, jiffies + when);
To fix the issue, hold idev if mod_timer() return 0.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.10.105 < 3.11 | 3.11 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < c6395e32935d35e6f935e7caf1c2dac5a95943b4 | c6395e32935d35e6f935e7caf1c2dac5a95943b4 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < df62fdcd004afa72ecbed0e862ebb983acd3aa57 | df62fdcd004afa72ecbed0e862ebb983acd3aa57 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < c7eeba47058532f6077d6a658e38b6698f6ae71a | c7eeba47058532f6077d6a658e38b6698f6ae71a |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < 2ad31ce40e8182860b631e37209e93e543790b7c | 2ad31ce40e8182860b631e37209e93e543790b7c |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < 82abd1c37d3bf2a2658b34772c17a25a6f9cca42 | 82abd1c37d3bf2a2658b34772c17a25a6f9cca42 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < 436b7cc7eae7851c184b671ed7a4a64c750b86f7 | 436b7cc7eae7851c184b671ed7a4a64c750b86f7 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < 1f656e483eb4733d62f18dfb206a49b78f60f495 | 1f656e483eb4733d62f18dfb206a49b78f60f495 |
| linux | linux | >= b7b1bfce0bb68bd8f6e62a28295922785cc63781 < 06a0716949c22e2aefb648526580671197151acc | 06a0716949c22e2aefb648526580671197151acc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 3.10.105 < 4.14.322 | 4.14.322 |
| linux | linux_kernel | >= 4.15 < 4.19.291 | 4.19.291 |
| linux | linux_kernel | >= 4.20 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 5.11 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.16 < 6.1.40 | 6.1.40 |
| linux | linux_kernel | >= 5.5 < 5.10.188 | 5.10.188 |
| linux | linux_kernel | >= 6.2 < 6.4.5 | 6.4.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ipv6/addrconf: fix a potential refcount underflow for idev
vendor_redhat·2025-09-15·CVSS 5.5
CVE-2023-53189 [MEDIUM] CWE-415 kernel: ipv6/addrconf: fix a potential refcount underflow for idev
kernel: ipv6/addrconf: fix a potential refcount underflow for idev
In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconf_mod_rs_timer(), reference idev depends on whether
rs_timer is not pending. Then modify rs_timer timeout.
There is a time gap in [1], during which if the pending rs_timer
becomes not pending. It will miss to hold idev, but the rs_timer
is activated. Thus rs_timer callback function addrconf_rs_timer()
will be executed and put idev later without holding idev. A refcount
underflow issue for idev can be caused by this.
if (!timer_pending(&idev->rs_timer))
in6_dev_hold(idev);
rs_timer, jiffies + when);
To fix the issue, hold idev if mod_timer() return 0.
Statement: A race condition in th
Debian
CVE-2023-53189: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6/addrco...
vendor_debian·2023·CVSS 5.5
CVE-2023-53189 [MEDIUM] CVE-2023-53189: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6/addrco...
In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved (fixed in 5.10.191-1)
forky: re
GHSA
GHSA-4hgc-47xp-7m5f: In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconf_mod_r
ghsa_unreviewed·2025-09-15
CVE-2023-53189 [MEDIUM] CWE-191 GHSA-4hgc-47xp-7m5f: In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconf_mod_r
In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconf_mod_rs_timer(), reference idev depends on whether
rs_timer is not pending. Then modify rs_timer timeout.
There is a time gap in [1], during which if the pending rs_timer
becomes not pending. It will miss to hold idev, but the rs_timer
is activated. Thus rs_timer callback function addrconf_rs_timer()
will be executed and put idev later without holding idev. A refcount
underflow issue for idev can be caused by this.
if (!timer_pending(&idev->rs_timer))
in6_dev_hold(idev);
rs_timer, jiffies + when);
To fix the issue, hold idev if mod_timer() return 0.
OSV
CVE-2023-53189: In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_
osv·2025-09-15·CVSS 5.5
CVE-2023-53189 [MEDIUM] CVE-2023-53189: In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_
In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/06a0716949c22e2aefb648526580671197151acchttps://git.kernel.org/stable/c/1f656e483eb4733d62f18dfb206a49b78f60f495https://git.kernel.org/stable/c/2ad31ce40e8182860b631e37209e93e543790b7chttps://git.kernel.org/stable/c/436b7cc7eae7851c184b671ed7a4a64c750b86f7https://git.kernel.org/stable/c/82abd1c37d3bf2a2658b34772c17a25a6f9cca42https://git.kernel.org/stable/c/c6395e32935d35e6f935e7caf1c2dac5a95943b4https://git.kernel.org/stable/c/c7eeba47058532f6077d6a658e38b6698f6ae71ahttps://git.kernel.org/stable/c/df62fdcd004afa72ecbed0e862ebb983acd3aa57
2025-09-15
Published