CVE-2023-53999
published 2025-12-24CVE-2023-53999: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra…
PriorityP420medium5.5
EPSS
0.17%
6.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s)
hex dump (first 32 bytes):
01 00 00 00 19 00 00 00 03 f0 00 00 04 00 00 00 ................
98 77 67 41 81 88 ff ff 98 77 67 41 81 88 ff ff .wgA.....wgA....
backtrace:
[] kmalloc_trace+0x27/0x120
[] mlx5e_tc_int_port_get+0x3f3/0xe20 [mlx5_core]
[] mlx5e_tc_add_fdb_flow+0x473/0xcf0 [mlx5_core]
[] __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]
[] mlx5e_configure_flower+0xd40/0x4c40 [mlx5_core]
[] mlx5e_rep_indr_offload.isra.0+0x10e/0x1c0 [mlx5_core]
[] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core]
[] tc_setup_cb_add+0x1cf/0x410
[] fl_hw_replace_filter+0x38f/0x670 [cls_flower]
[] fl_change+0x1fd5/0x4430 [cls_flower]
[] tc_new_tfilter+0x867/0x2010
[] rtnetlink_rcv_msg+0x6fc/0x9f0
[] netlink_rcv_skb+0x12c/0x360
[] netlink_unicast+0x438/0x710
[] netlink_sendmsg+0x794/0xc50
[] sock_sendmsg+0xc5/0x190
So fix this by moving int_port cleanup code to the flow attribute
free helper, which is used by all the attribute free cases.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.4.11-1 (forky) | linux 6.4.11-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 8300f225268be9ee2c0daf5a3f23929fcdcbf213 < bc1918bac0f30e3f551ef5649b53062917db55fa | bc1918bac0f30e3f551ef5649b53062917db55fa |
| linux | linux | >= 8300f225268be9ee2c0daf5a3f23929fcdcbf213 < ac5da544a3c2047cbfd715acd9cec8380d7fe5c6 | ac5da544a3c2047cbfd715acd9cec8380d7fe5c6 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 5.18.0 < 6.4.11 | 6.4.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53999: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the
osv·2025-12-24
CVE-2023-53999 CVE-2023-53999: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed. The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 0
GHSA
GHSA-x7x5-xvrp-r655: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and t
ghsa_unreviewed·2025-12-24
CVE-2023-53999 GHSA-x7x5-xvrp-r655: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and t
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s)
hex dump (first 32 bytes):
01 00 00 00 1
OSV
net/mlx5e: TC, Fix internal port memory leak
osv·2025-12-24
CVE-2023-53999 net/mlx5e: TC, Fix internal port memory leak
net/mlx5e: TC, Fix internal port memory leak
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handler20", pid 50121, jiffies 4296973009 (age 642.
Red Hat
kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-53999 [MEDIUM] CWE-772 kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handler20", pid 50121, j
Debian
CVE-2023-53999: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ...
vendor_debian·2023
CVE-2023-53999 CVE-2023-53999: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: ...
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed. The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 0
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-53999 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53999 CVE-2023-53999 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53999 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handler20", pid 50121, j
Bugzilla
CVE-2023-53999 kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
bugzilla·2025-12-24
CVE-2023-53999 [MEDIUM] CVE-2023-53999 kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
CVE-2023-53999 kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added
to post_act table. It's possible to trigger memleak when the rule
forwards packets from internal port and over tunnel, in the case that,
for example, CT 'new' state offload is allowed. As int_port object is
assigned to the flow attribute of post_act rule, and its refcnt is
incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is
not called, the refcnt is never decremented, then int_port is never
freed.
The kmemleak reports the following error:
unreferenced object 0xffff888128204b80 (size 64):
comm "handle
2025-12-24
Published