CVE-2023-54142
published 2025-12-24CVE-2023-54142: In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
4.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline]
BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401
CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:351 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:462
kasan_report+0xb2/0xe0 mm/kasan/report.c:572
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
do_raw_spin_lock include/linux/spinlock.h:186 [inline]
__raw_spin_lock_bh include/linux/sp
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 01f3c64e405ab3d25887d080a103ad76f30661d2 < d38039697184aacff1cf576e14ef583112fdefef | d38039697184aacff1cf576e14ef583112fdefef |
| linux | linux | >= 4.14.135 < 4.14.322 | 4.14.322 |
| linux | linux | >= 4.19.61 < 4.19.291 | 4.19.291 |
| linux | linux | >= 5.1.20 < 5.2 | 5.2 |
| linux | linux | >= 5.2.3 < 5.3 | 5.3 |
| linux | linux | >= e117a04133c673cc54292e12086a8177cd9bd4a4 < e5aa6d829831a55a693dbaeb58f8d22ba7f2b3e6 | e5aa6d829831a55a693dbaeb58f8d22ba7f2b3e6 |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < 9c9662e2512b5e4ee7b03108802c5222e0fa77a4 | 9c9662e2512b5e4ee7b03108802c5222e0fa77a4 |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < bccc7ace12e69dee4684a3bb4b69737972e570d6 | bccc7ace12e69dee4684a3bb4b69737972e570d6 |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < ebd6d2077a083329110695a996c00e8ca94bc640 | ebd6d2077a083329110695a996c00e8ca94bc640 |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < 17d6b6354f0025b7c10a56da783fd0cbb3819c5d | 17d6b6354f0025b7c10a56da783fd0cbb3819c5d |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < dae6095bdb24f537b4798ffd9201515b97bac94e | dae6095bdb24f537b4798ffd9201515b97bac94e |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < 58fa341327fdb4bdf92597fd8796a9abc8d20ea3 | 58fa341327fdb4bdf92597fd8796a9abc8d20ea3 |
| linux | linux | >= e198987e7dd7d3645a53875151cd6f8fc425b706 < ce3aee7114c575fab32a5e9e939d4bbb3dcca79f | ce3aee7114c575fab32a5e9e939d4bbb3dcca79f |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 4.14.322 | 4.14.322 |
| linux | linux_kernel | >= 4.15.0 < 4.19.291 | 4.19.291 |
| linux | linux_kernel | >= 4.20.0 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 5.11.0 < 6.1.39 | 6.1.39 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-54142: In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy()
osv·2025-12-24
CVE-2023-54142 CVE-2023-54142: In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy()
In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, but release_sock() is called after sock_put() releases the last refcnt. [0]: BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] BUG: KASAN: sla
OSV
gtp: Fix use-after-free in __gtp_encap_destroy().
osv·2025-12-24
CVE-2023-54142 gtp: Fix use-after-free in __gtp_encap_destroy().
gtp: Fix use-after-free in __gtp_encap_destroy().
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock incl
GHSA
GHSA-frp2-qrfx-2m63: In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy()
ghsa_unreviewed·2025-12-24
CVE-2023-54142 GHSA-frp2-qrfx-2m63: In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy()
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
BUG: KASAN
Red Hat
kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
vendor_redhat·2025-12-24
CVE-2023-54142 kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock in
Debian
CVE-2023-54142: linux - In the Linux kernel, the following vulnerability has been resolved: gtp: Fix us...
vendor_debian·2023
CVE-2023-54142 CVE-2023-54142: linux - In the Linux kernel, the following vulnerability has been resolved: gtp: Fix us...
In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, but release_sock() is called after sock_put() releases the last refcnt. [0]: BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] BUG: KASAN: sla
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-54142 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54142 CVE-2023-54142 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54142 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). 0
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace: __dump_stack lib/dump_stack.c:88 [inline]
dump_stack_
Bugzilla
CVE-2023-54142 kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
bugzilla·2025-12-24
CVE-2023-54142 CVE-2023-54142 kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
CVE-2023-54142 kernel: gtp: Fix use-after-free in __gtp_encap_destroy()
In the Linux kernel, the following vulnerability has been resolved:
gtp: Fix use-after-free in __gtp_encap_destroy().
syzkaller reported use-after-free in __gtp_encap_destroy(). [0]
It shows the same process freed sk and touched it illegally.
Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.
[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in
https://git.kernel.org/stable/c/17d6b6354f0025b7c10a56da783fd0cbb3819c5dhttps://git.kernel.org/stable/c/58fa341327fdb4bdf92597fd8796a9abc8d20ea3https://git.kernel.org/stable/c/9c9662e2512b5e4ee7b03108802c5222e0fa77a4https://git.kernel.org/stable/c/bccc7ace12e69dee4684a3bb4b69737972e570d6https://git.kernel.org/stable/c/ce3aee7114c575fab32a5e9e939d4bbb3dcca79fhttps://git.kernel.org/stable/c/d38039697184aacff1cf576e14ef583112fdefefhttps://git.kernel.org/stable/c/dae6095bdb24f537b4798ffd9201515b97bac94ehttps://git.kernel.org/stable/c/e5aa6d829831a55a693dbaeb58f8d22ba7f2b3e6https://git.kernel.org/stable/c/ebd6d2077a083329110695a996c00e8ca94bc640
2025-12-24
Published