CVE-2023-53559
published 2025-10-04CVE-2023-53559: In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 82fb41c5de243e7dfa90f32ca58e35adaff56c1d | 82fb41c5de243e7dfa90f32ca58e35adaff56c1d |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 7dfe23659f3677c08a60a0056cda2d91a79c15ca | 7dfe23659f3677c08a60a0056cda2d91a79c15ca |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < d34c30442d5e53a33cde79ca163320dbe2432cbd | d34c30442d5e53a33cde79ca163320dbe2432cbd |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 0b4d69539fdea138af2befe08893850c89248068 | 0b4d69539fdea138af2befe08893850c89248068 |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < e1e04cc2ef2c0c0866c19f5627149a76c2baae32 | e1e04cc2ef2c0c0866c19f5627149a76c2baae32 |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 2b05bf5dc437f7891dd409a3eaf5058459391c7a | 2b05bf5dc437f7891dd409a3eaf5058459391c7a |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 78e397a43e1c47321a4679cc49a6c4530bf820b9 | 78e397a43e1c47321a4679cc49a6c4530bf820b9 |
| linux | linux | >= f855691975bb06373a98711e4cfe2c224244b536 < 6018a266279b1a75143c7c0804dd08a5fc4c3e0b | 6018a266279b1a75143c7c0804dd08a5fc4c3e0b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.197-1 | 5.10.197-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 3.19.1 < 4.14.324 | 4.14.324 |
| linux | linux_kernel | >= 4.15 < 4.19.293 | 4.19.293 |
| linux | linux_kernel | >= 4.20 < 5.4.255 | 5.4.255 |
| linux | linux_kernel | >= 5.11 < 5.15.128 | 5.15.128 |
| linux | linux_kernel | >= 5.16 < 6.1.47 | 6.1.47 |
| linux | linux_kernel | >= 5.5 < 5.10.192 | 5.10.192 |
| linux | linux_kernel | >= 6.2 < 6.4.12 | 6.4.12 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53559: In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is
osv·2025-10-04·CVSS 7.8
CVE-2023-53559 [HIGH] CVE-2023-53559: In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
GHSA
GHSA-6v4x-gf5x-r6w5: In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device
ghsa_unreviewed·2025-10-04
CVE-2023-53559 [HIGH] CWE-416 GHSA-6v4x-gf5x-r6w5: In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Red Hat
kernel: ip_vti: fix potential slab-use-after-free in decode_session6
vendor_redhat·2025-10-04·CVSS 7.8
CVE-2023-53559 [HIGH] CWE-825 kernel: ip_vti: fix potential slab-use-after-free in decode_session6
kernel: ip_vti: fix potential slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
A use-after-free flaw was found in the Linux kernel's ip_vti (IPsec Virtual Tunnel Interface) implementation when transmitting IPv6
Debian
CVE-2023-53559: linux - In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix...
vendor_debian·2023·CVSS 7.8
CVE-2023-53559 [HIGH] CVE-2023-53559: linux - In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix...
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved (fixed in 5.10.197-1)
forky: resolved (fixed in 6.4.13-1)
sid: resolved (fixed in 6.4.13-1)
trixie: resolved (fixed in 6.4.13-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7ahttps://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0bhttps://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15cahttps://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1dhttps://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbdhttps://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32
2025-10-04
Published