cbcvebase.
CVE-2023-53999
published 2025-12-24

CVE-2023-53999: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra…

PriorityP420medium5.5
EPSS
0.17%
6.2th percentile
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed. The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 00 00 00 03 f0 00 00 04 00 00 00 ................ 98 77 67 41 81 88 ff ff 98 77 67 41 81 88 ff ff .wgA.....wgA.... backtrace: [] kmalloc_trace+0x27/0x120 [] mlx5e_tc_int_port_get+0x3f3/0xe20 [mlx5_core] [] mlx5e_tc_add_fdb_flow+0x473/0xcf0 [mlx5_core] [] __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] [] mlx5e_configure_flower+0xd40/0x4c40 [mlx5_core] [] mlx5e_rep_indr_offload.isra.0+0x10e/0x1c0 [mlx5_core] [] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core] [] tc_setup_cb_add+0x1cf/0x410 [] fl_hw_replace_filter+0x38f/0x670 [cls_flower] [] fl_change+0x1fd5/0x4430 [cls_flower] [] tc_new_tfilter+0x867/0x2010 [] rtnetlink_rcv_msg+0x6fc/0x9f0 [] netlink_rcv_skb+0x12c/0x360 [] netlink_unicast+0x438/0x710 [] netlink_sendmsg+0x794/0xc50 [] sock_sendmsg+0xc5/0x190 So fix this by moving int_port cleanup code to the flow attribute free helper, which is used by all the attribute free cases.

Affected

7 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.4.11-1 (forky)linux 6.4.11-1 (forky)
linuxlinux
linuxlinux>= 8300f225268be9ee2c0daf5a3f23929fcdcbf213 < bc1918bac0f30e3f551ef5649b53062917db55fabc1918bac0f30e3f551ef5649b53062917db55fa
linuxlinux>= 8300f225268be9ee2c0daf5a3f23929fcdcbf213 < ac5da544a3c2047cbfd715acd9cec8380d7fe5c6ac5da544a3c2047cbfd715acd9cec8380d7fe5c6
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 5.18.0 < 6.4.116.4.11
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.