Read the docs
TI-2023-29407 Aliases CVE-2023-53107GHSA-wmmr-m98c-g94f

veth: Fix use after free in XDP_REDIRECT

Priority LOW 35CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: veth: Fix use after free in XDP_REDIRECT Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") introduced a bug where it tried to use pskb_expand_head() if the headroom was less than XDP_PACKET_HEADROOM. This however uses kmalloc to expand the head, which will later allow consume_skb() to free the skb while is it still in use by AF_XDP. Previously if the headroom was less than XDP_PACKET_HEADROOM we continued on to allocate a new skb from pages so this restores that behavior. BUG: KASAN: use-after-free in __xsk_rcv+0x18d/0x2c0 Read of size 78 at addr ffff888976250154 by task napi/iconduit-g/148640 CPU: 5 PID: 148640 Comm: napi/iconduit-g Kdump: loaded Tainted: G O 6.1.4-cloudflare-kasan-2023.1.2 #1 Hardware name: Quanta Computer Inc. QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018 Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_report+0x170/0x473 ? __xsk_rcv+0x18d/0x2c0 kasan_report+0xad/0x130 ? __xsk_rcv+0x18d/0x2c0 kasan_check_range+0x149/0x1a0 memcpy+0x20/0x60 __xsk_rcv+0x18d/0x2c0 __xsk_map_redirect+0x1f3/0x490 ? veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] xdp_do_redirect+0x5ca/0xd60 veth_xdp_rcv_skb+0x935/0x1ba0 [veth] ? __netif_receive_skb_list_core+0x671/0x920 ? veth_xdp+0x670/0x670 [veth] veth_xdp_rcv+0x304/0xa20 [veth] ? do_xdp_generic+0x150/0x150 ? veth_xdp_rcv_one+0xde0/0xde0 [veth] ? _raw_spin_lock_bh+0xe0/0xe0 ? newidle_balance+0x887/0xe30 ? __perf_event_task_sched_in+0xdb/0x800 veth_poll+0x139/0x571 [veth] ? veth_xdp_rcv+0xa20/0xa20 [veth] ? _raw_spin_unlock+0x39/0x70 ? finish_task_switch.isra.0+0x17e/0x7d0 ? __switch_to+0x5cf/0x1070 ? __schedule+0x95b/0x2640 ? io_schedule_timeout+0x160/0x160 __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 ? __napi_poll+0x440/0x440 ? __kthread_parkme+0xc6/0x1f0 ? __napi_poll+0x440/0x440 kthread+0x2a2/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> Freed by task 148640: kasan_save_stack+0x23/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x169/0x1d0 slab_free_freelist_hook+0xd2/0x190 __kmem_cache_free+0x1a1/0x2f0 skb_release_data+0x449/0x600 consume_skb+0x9f/0x1c0 veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] veth_xdp_rcv+0x304/0xa20 [veth] veth_poll+0x139/0x571 [veth] __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 kthread+0x2a2/0x340 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888976250000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 340 bytes inside of 2048-byte region [ffff888976250000, ffff888976250800) The buggy address belongs to the physical page: page:00000000ae18262a refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x976250 head:00000000ae18262a order:3 compound_mapcount:0 compound_pincount:0 flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff) raw: 002ffff800010200 0000000000000000 dead000000000122 ffff88810004cf00 raw: 0000000000000000 0000000080080008 00000002ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888976250000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888976250080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888976250100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888976250180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888976250200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1.21, 6.2.8, 6.3Red Hat: 4 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.18 and later6.1.21, 6.2.8, 6.3Patch availableCNA
  • Linux VendorLinux Affected 5.18 and later Fixed in 6.1.21, 6.2.8, 6.3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.18 to before 6.1.21; 6.2 to before 6.2.8VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*6.3 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*6.3 rc2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.18 to before 6.1.21; 6.2 to before 6.2.8 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:* Versions 6.3 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:* Versions 6.3 rc2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.1.21, 6.2.8, 6.3

Red Hat 4 advisories

  • RHSA-2025:8399 Released 2025-06-02 · Red Hat rating Important
    kpatch-patch-5_14_0-284_104_1, kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_52_1, kpatch-patch-5_14_0-284_79_1, and kpatch-patch-5_14_0-284_92_1 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) kpatch-patch-5_14_0-284_104_1-1-4.el9_2, kpatch-patch-5_14_0-284_117_1-1-1.el9_2, kpatch-patch-5_14_0-284_52_1-1-12.el9_2 +2
  • RHSA-2025:8134 Released 2025-05-26 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt-5.14.0-284.118.1.rt14.403.el9_2, kernel-rt-core-5.14.0-284.118.1.rt14.403.el9_2, kernel-rt-debug-5.14.0-284.118.1.rt14.403.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt-5.14.0-284.118.1.rt14.403.el9_2, kernel-rt-core-5.14.0-284.118.1.rt14.403.el9_2, kernel-rt-debug-5.14.0-284.118.1.rt14.403.el9_2 +11
  • RHSA-2025:8133 Released 2025-05-26 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-tools-libs-devel-5.14.0-284.118.1.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-64k-debug-devel-5.14.0-284.118.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.118.1.el9_2, kernel-64k-devel-5.14.0-284.118.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool-7.0.0-284.118.1.el9_2, kernel-5.14.0-284.118.1.el9_2, kernel-64k-5.14.0-284.118.1.el9_2 +29
Show 1 more Red Hat advisories
  • RHSA-2023:6583 Released 2023-11-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-362.8.1.el9_3, libperf-5.14.0-362.8.1.el9_3
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-362.8.1.el9_3, kernel-64k-debug-devel-matched-5.14.0-362.8.1.el9_3, kernel-64k-devel-5.14.0-362.8.1.el9_3 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.2.0-362.8.1.el9_3, kernel-5.14.0-362.8.1.el9_3, kernel-64k-5.14.0-362.8.1.el9_3 +29
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +9
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2025:8133
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:8133
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:8399
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2025:8133
Red Hat Enterprise Linux Real Time EUS (v.9.2)Fixed RHSA-2025:8134
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2)Fixed RHSA-2025:8134
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-53107
  2. 2026-10-03 Alias added: GHSA-wmmr-m98c-g94f
  3. 2026-10-16 CISA SSVC decision points changed

References

Patch 3

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences