CVE-2023-53863 — Incorrect Calculation of Buffer Size in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.1%
top 80.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 9
Description
In the Linux kernel, the following vulnerability has been resolved:
netlink: do not hard code device address lenth in fdb dumps
syzbot reports that some netdev devices do not have a six bytes
address [1]
Replace ETH_ALEN by dev->addr_len.
[1] (Case of a device where dev->addr_len = 4)
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169
instrument_copy_to_user include/linux/instr…
Affected Packages4 packages
▶CVEListV5linux/linuxd83b060360485454fcd6870340ec01d6f96f2295 — 61d1bf3c34bf5fe936c50d1a4bc460babcc85e88+9
🔴Vulnerability Details
3OSV▶
CVE-2023-53863: In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that so↗2025-12-09
GHSA▶
GHSA-44vj-whpr-3frv: In the Linux kernel, the following vulnerability has been resolved:
netlink: do not hard code device address lenth in fdb dumps
syzbot reports that↗2025-12-09