CVE-2023-54012
published 2025-12-24CVE-2023-54012: In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.17%
6.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features().
So, the NETDEV_FEAT_CHANGE notification logic of each lower interface
work iteratively.
But generated NETDEV_FEAT_CHANGE event is also sent to the upper
interface too.
upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own
lower interfaces again.
lower and upper interfaces receive this event and generate this
event again and again.
So, the stack overflow occurs.
But it is not the infinite loop issue.
Because the netdev_sync_lower_features() updates features before
generating the NETDEV_FEAT_CHANGE event.
Already synchronized lower interfaces skip notification logic.
So, it is just the problem that iteration logic is changed to the
recursive unexpectedly due to the notification mechanism.
Reproducer:
ip link add team0 type team
ethtool -K team0 lro on
for i in {1..200}
do
ip link add team$i master team0 type team
ethtool -K team$i lro on
done
ethtool -K team0 lro off
In order to fix it, the notifier_ctx member of bonding/team is introduced.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < 9ea0c5f90a27b5b884d880e146e0f65f3052e401 | 9ea0c5f90a27b5b884d880e146e0f65f3052e401 |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < 4bb955c4d2830a58c08e2a48ab75d75368e3ff36 | 4bb955c4d2830a58c08e2a48ab75d75368e3ff36 |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < cf3b5cd7127cc10c5b12400c545f263f0e5e715c | cf3b5cd7127cc10c5b12400c545f263f0e5e715c |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < ed66e6327a69fec95034cda2ac5b6a57b8b3b622 | ed66e6327a69fec95034cda2ac5b6a57b8b3b622 |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < 6bf00bb3dc7e5b9fb05488e11616e65d64e975fa | 6bf00bb3dc7e5b9fb05488e11616e65d64e975fa |
| linux | linux | >= fd867d51f889aec11cca235ebb008578780d052d < ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6 | ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 4.4.0 < 5.4.244 | 5.4.244 |
| linux | linux_kernel | >= 5.11.0 < 5.15.114 | 5.15.114 |
| linux | linux_kernel | >= 5.16.0 < 6.1.31 | 6.1.31 |
| linux | linux_kernel | >= 5.5.0 < 5.10.181 | 5.10.181 |
| linux | linux_kernel | >= 6.2.0 < 6.3.5 | 6.3.5 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-54012 [MEDIUM] CWE-674 kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features
Debian
CVE-2023-54012: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix st...
vendor_debian·2023
CVE-2023-54012 CVE-2023-54012: linux - In the Linux kernel, the following vulnerability has been resolved: net: fix st...
In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This propagation logic should be worked as the iteration, not recursively. But it works recursively due to the netdev notification unexpectedly. This problem occurs when it disables LRO only for the team and bonding interface type. team0 | +------+------+-----+-----+ | | | | | team1 team2 team3 ... team200 If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE event to its own lower interfaces(team1 ~ team200). It is worked by netdev_sync_lower_features(). So, the NETDEV_FEAT_CHANGE notification logic of each lower interface wor
OSV
net: fix stack overflow when LRO is disabled for virtual interfaces
osv·2025-12-24
CVE-2023-54012 net: fix stack overflow when LRO is disabled for virtual interfaces
net: fix stack overflow when LRO is disabled for virtual interfaces
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features().
GHSA
GHSA-2vmp-q8v6-7qc9: In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the vir
ghsa_unreviewed·2025-12-24
CVE-2023-54012 GHSA-2vmp-q8v6-7qc9: In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the vir
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features().
So, the NETDEV_FEAT_CHANGE notification logic of each lower interface
OSV
CVE-2023-54012: In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtu
osv·2025-12-24
CVE-2023-54012 CVE-2023-54012: In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtu
In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This propagation logic should be worked as the iteration, not recursively. But it works recursively due to the netdev notification unexpectedly. This problem occurs when it disables LRO only for the team and bonding interface type. team0 | +------+------+-----+-----+ | | | | | team1 team2 team3 ... team200 If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE event to its own lower interfaces(team1 ~ team200). It is worked by netdev_sync_lower_features(). So, the NETDEV_FEAT_CHANGE notification logic of each lower interface wor
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54012 kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
bugzilla·2025-12-24
CVE-2023-54012 [MEDIUM] CVE-2023-54012 kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
CVE-2023-54012 kernel: net: fix stack overflow when LRO is disabled for virtual interfaces
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_
Wiz
CVE-2023-54012 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54012 CVE-2023-54012 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54012 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.
team0
|
+------+------+-----+-----+
| | | | |
team1 team2 team3 ... team200
If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_feature
https://git.kernel.org/stable/c/4bb955c4d2830a58c08e2a48ab75d75368e3ff36https://git.kernel.org/stable/c/6bf00bb3dc7e5b9fb05488e11616e65d64e975fahttps://git.kernel.org/stable/c/9ea0c5f90a27b5b884d880e146e0f65f3052e401https://git.kernel.org/stable/c/ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6https://git.kernel.org/stable/c/cf3b5cd7127cc10c5b12400c545f263f0e5e715chttps://git.kernel.org/stable/c/ed66e6327a69fec95034cda2ac5b6a57b8b3b622
2025-12-24
Published