CVE-2023-53439 — Missing Release of Memory after Effective Lifetime in Linux

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-703 — Improper Check or Handling of Exceptional Conditions5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 97.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedSep 18

Description

In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent callers to accidentaly set skb->transport_header to 0xFFFF. Note that only fuzzers can possibly do this today. syzbot reported: WARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 skb_transport_offset include/linux/skbuff.h:2956 [inline]…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel5.19 — 6.1.30+2
▶Debianlinux/linux_kernel< 6.1.37-1+2
▶CVEListV5linux/linux66e4c8d950083df8e12981babca788e1635c92b6 — 3e785c8deb046305c61b9fa02265d0cb900c4a45+3
▶debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2023-53439: In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transpor↗2025-09-18
▶
GHSA
GHSA-67x9-72qp-w8c9: In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transp↗2025-09-18
▶

📋Vendor Advisories

2
Red Hat
kernel: net: skb_partial_csum_set() fix against transport header magic value↗2025-09-18
▶
Debian
CVE-2023-53439: linux - In the Linux kernel, the following vulnerability has been resolved: net: skb_pa...↗2023
▶
CVE-2023-53439 — Linux vulnerability | cvebase