CVE-2023-53600
published 2025-10-04CVE-2023-53600: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in…
PriorityP428high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.14%
3.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
[..]
kasan_report+0x105/0x140
ip_compute_csum+0x134/0x220
iptunnel_pmtud_build_icmp+0x554/0x1020
skb_tunnel_check_pmtu+0x513/0xb80
vxlan_xmit_one+0x139e/0x2ef0
vxlan_xmit+0x1867/0x2760
dev_hard_start_xmit+0x1ee/0x4f0
br_dev_queue_push_xmit+0x4d1/0x660
[..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and iperf3 is no longer stuck.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 5850c391fd7e25662334cb3cbf29a62bcbff1084 | 5850c391fd7e25662334cb3cbf29a62bcbff1084 |
| linux | linux | >= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < e95808121953410db8c59f0abfde70ac0d34222c | e95808121953410db8c59f0abfde70ac0d34222c |
| linux | linux | >= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc | da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc |
| linux | linux | >= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < fe6a9f7516735be9fdabab00e47ef7a3403a174d | fe6a9f7516735be9fdabab00e47ef7a3403a174d |
| linux | linux | >= 4cb47a8644cc9eb8ec81190a50e79e6530d0297f < 6a7ac3d20593865209dceb554d8b3f094c6bd940 | 6a7ac3d20593865209dceb554d8b3f094c6bd940 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 5.11 < 5.15.127 | 5.15.127 |
| linux | linux_kernel | >= 5.16 < 6.1.46 | 6.1.46 |
| linux | linux_kernel | >= 5.9 < 5.10.191 | 5.10.191 |
| linux | linux_kernel | >= 6.2 < 6.4.11 | 6.4.11 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: tunnels: fix kasan splat when generating ipv4 pmtu error
vendor_redhat·2025-10-04·CVSS 7.1
CVE-2023-53600 [HIGH] CWE-125 kernel: tunnels: fix kasan splat when generating ipv4 pmtu error
kernel: tunnels: fix kasan splat when generating ipv4 pmtu error
In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
[..]
kasan_report+0x105/0x140
ip_compute_csum+0x134/0x220
iptunnel_pmtud_build_icmp+0x554/0x1020
skb_tunnel_check_pmtu+0x513/0xb80
vxlan_xmit_one+0x139e/0x2ef0
vxlan_xmit+0x1867/0x2760
dev_hard_start_xmit+0x1ee/0x4f0
br_dev_queue_push_xmit+0x4d1/0x660
[..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and i
Debian
CVE-2023-53600: linux - In the Linux kernel, the following vulnerability has been resolved: tunnels: fi...
vendor_debian·2023·CVSS 7.1
CVE-2023-53600 [HIGH] CVE-2023-53600: linux - In the Linux kernel, the following vulnerability has been resolved: tunnels: fi...
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.
Scope: local
bookworm: resolved (fixed i
VulDB
Linux Kernel up to 5.10.190/5.15.126/6.1.45/6.4.10 tunnels ip_compute_csum out-of-bounds (EUVD-2023-60008 / Nessus ID 302981)
vuldb·2026-04-28·CVSS 7.1
CVE-2023-53600 [HIGH] Linux Kernel up to 5.10.190/5.15.126/6.1.45/6.4.10 tunnels ip_compute_csum out-of-bounds (EUVD-2023-60008 / Nessus ID 302981)
A vulnerability described as critical has been identified in Linux Kernel up to 5.10.190/5.15.126/6.1.45/6.4.10. The impacted element is the function ip_compute_csum of the component tunnels. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is handled as CVE-2023-53600. The attack can only be done within the local network. There is not any exploit available.
Upgrading the affected component is recommended.
OSV
CVE-2023-53600: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp
osv·2025-10-04·CVSS 7.1
CVE-2023-53600 [HIGH] CVE-2023-53600: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.
GHSA
GHSA-qh3w-rq3m-fpq5: In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an ic
ghsa_unreviewed·2025-10-04
CVE-2023-53600 [HIGH] CWE-125 GHSA-qh3w-rq3m-fpq5: In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an ic
In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
[..]
kasan_report+0x105/0x140
ip_compute_csum+0x134/0x220
iptunnel_pmtud_build_icmp+0x554/0x1020
skb_tunnel_check_pmtu+0x513/0xb80
vxlan_xmit_one+0x139e/0x2ef0
vxlan_xmit+0x1867/0x2760
dev_hard_start_xmit+0x1ee/0x4f0
br_dev_queue_push_xmit+0x4d1/0x660
[..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and iperf3 is no longer stuck.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/5850c391fd7e25662334cb3cbf29a62bcbff1084https://git.kernel.org/stable/c/6a7ac3d20593865209dceb554d8b3f094c6bd940https://git.kernel.org/stable/c/da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cchttps://git.kernel.org/stable/c/e95808121953410db8c59f0abfde70ac0d34222chttps://git.kernel.org/stable/c/fe6a9f7516735be9fdabab00e47ef7a3403a174d
2025-10-04
Published