vxlan: Fix nexthop hash size
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 13 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-129 and the CVSS impact.
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example: hash = -912054133 num_nh_buckets = 2 bucket_index = 65535 which leads to the following panic: BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ? ndisc_send_skb+0x2c0/0x960 ? __pfx_lock_release+0x10/0x10 ? __local_bh_enable_ip+0x93/0x110 ? lock_is_held_type+0xe7/0x140 ndisc_send_skb+0x4be/0x960 ? __pfx_ndisc_send_skb+0x10/0x10 ? mark_held_locks+0x65/0x90 ? find_held_lock+0x83/0xa0 ndisc_send_ns+0xb0/0x110 ? __pfx_ndisc_send_ns+0x10/0x10 addrconf_dad_work+0x631/0x8e0 ? lock_acquire+0x180/0x3f0 ? __pfx_addrconf_dad_work+0x10/0x10 ? mark_held_locks+0x24/0x90 process_one_work+0x582/0x9c0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x24/0x90 worker_thread+0x93/0x630 ? __kthread_parkme+0xdc/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1a5/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ---truncated---
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 5.8 and later | 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5 | Patch available | CNA |
- Linux VendorLinux Affected 5.8 and later Fixed in 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.8 to before 5.10.190; 5.11 to before 5.15.126; 5.16 to before 6.1.45; 6.2 to before 6.4.10 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* | 6.5 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* | 6.5 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* | 6.5 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* | 6.5 rc4 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.8 to before 5.10.190; 5.11 to before 5.15.126; 5.16 to before 6.1.45; 6.2 to before 6.4.10 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* Versions 6.5 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* Versions 6.5 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* Versions 6.5 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* Versions 6.5 rc4 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5
Red Hat 5 advisories
- RHSA-2026:3358 Released 2026-02-25 · Red Hat rating Moderatekernel-rt security update
- Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-core-5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-5.14.0-284.158.1.rt14.443.el9_2 +9
- Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-core-5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-5.14.0-284.158.1.rt14.443.el9_2 +11
- RHSA-2026:3267 Released 2026-02-25 · Red Hat rating Moderatekernel security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.158.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.158.1.el9_2, kernel-64k-devel-5.14.0-284.158.1.el9_2 +10
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.158.1.el9_2, kernel-5.14.0-284.158.1.el9_2, kernel-64k-5.14.0-284.158.1.el9_2 +29
- RHSA-2026:2577 Released 2026-02-11 · Red Hat rating Moderatekernel-rt security update
- Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt-5.14.0-70.165.1.rt21.237.el9_0, kernel-rt-core-5.14.0-70.165.1.rt21.237.el9_0, kernel-rt-debug-5.14.0-70.165.1.rt21.237.el9_0 +9
- Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt-5.14.0-70.165.1.rt21.237.el9_0, kernel-rt-core-5.14.0-70.165.1.rt21.237.el9_0, kernel-rt-debug-5.14.0-70.165.1.rt21.237.el9_0 +7
Show 2 more Red Hat advisories
- RHSA-2026:2573 Released 2026-02-11 · Red Hat rating Moderatekernel security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-debug-devel-5.14.0-70.165.1.el9_0, kernel-debug-devel-matched-5.14.0-70.165.1.el9_0, kernel-devel-5.14.0-70.165.1.el9_0 +5
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) bpftool-5.14.0-70.165.1.el9_0, kernel-5.14.0-70.165.1.el9_0, kernel-abi-stablelists-5.14.0-70.165.1.el9_0 +14
- RHSA-2024:2394 Released 2024-04-30 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.13.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.13.1.el9_4, kernel-64k-devel-5.14.0-427.13.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.13.1.el9_4, kernel-5.14.0-427.13.1.el9_4, kernel-64k-5.14.0-427.13.1.el9_4 +29
- Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.13.1.el9_4, libperf-5.14.0-427.13.1.el9_4
- Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +11
- Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2394 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:2573 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:3267 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:2394 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2026:2573 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2026:3267 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:2394 |
| Red Hat Enterprise Linux NFV (v. 9) | Fixed | RHSA-2024:2394 |
| Red Hat Enterprise Linux NFV E4S (v.9.0) | Fixed | RHSA-2026:2577 |
| Red Hat Enterprise Linux RT (v. 9) | Fixed | RHSA-2024:2394 |
| Red Hat Enterprise Linux Real Time E4S (v.9.0) | Fixed | RHSA-2026:2577 |
| Red Hat Enterprise Linux Real Time E4S (v.9.2) | Fixed | RHSA-2026:3358 |
| Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) | Fixed | RHSA-2026:3358 |
Not affected: 3 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53192
- 2026-10-03 Alias added: GHSA-5ghm-j624-hfm6
- 2026-10-29 Affected versions changed · Red Hat
References
Patch 5
- https://git.kernel.org/stable/c/c650597647ecb318d02372277bdfd866c6829f78
- https://git.kernel.org/stable/c/32ef2c0c6cf11a076f0280a7866b9abc47821e19
- https://git.kernel.org/stable/c/7b8717658dff8b471cbfc124bf9b5ca4229579ed
- https://git.kernel.org/stable/c/23c195ce6f4aec86e1c9e1ea1c800381c4b465c7
- https://git.kernel.org/stable/c/0756384fb1bd38adb2ebcfd1307422f433a1d772
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2023-53192 · CVE Program
- CVE-2023-53192 · NVD
- FIRST EPSS
- GHSA-5ghm-j624-hfm6 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-53192 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences