CVE-2023-53365

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

State: Published
Severity: 5.5 Medium
Published: Sep 17, 2025
Updated: May 11, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20

When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before a96d74d1076c82a4cef02c150d9996b21354c78dAffected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 8382e7ed2d63e6c2daf6881fa091526dc6c879cdAffected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 0438e60a00d4e335b3c36397dbf26c74b5d13ef0Affected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 1683124129a4263dd5bce2475bab110e95fa0346Affected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 1bb54a21f4d9b88442f8c3307c780e2db64417e4Affected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 691a09eecad97e745b9aa0e3918db46d020bdacbAffected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 3326c711f18d18fe6e1f5d83d3a7eab07e5a1560Affected 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 30e0191b16e8a58e4620fa3e2839ddc7b9d4281cAffected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 4.14.322 through 4.14.Not affected 4.19.291 through 4.19.Not affected 5.4.253 through 5.4.Not affected 5.10.190 through 5.10.Not affected 5.15.126 through 5.15.Not affected 6.1.45 through 6.1.Not affected 6.4.10 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before a96d74d1076c82a4cef02c150d9996b21354c78dAffected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 8382e7ed2d63e6c2daf6881fa091526dc6c879cdAffected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 0438e60a00d4e335b3c36397dbf26c74b5d13ef0Affected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 1683124129a4263dd5bce2475bab110e95fa0346Affected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 1bb54a21f4d9b88442f8c3307c780e2db64417e4Affected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 691a09eecad97e745b9aa0e3918db46d020bdacbAffected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 3326c711f18d18fe6e1f5d83d3a7eab07e5a1560Affected
14fb64e1f449ef6666f1c3a3fa4e13aec669b98d to before 30e0191b16e8a58e4620fa3e2839ddc7b9d4281cAffected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
4.14.322 through 4.14.*Not affected
4.19.291 through 4.19.*Not affected
5.4.253 through 5.4.*Not affected
5.10.190 through 5.10.*Not affected
5.15.126 through 5.15.*Not affected
6.1.45 through 6.1.*Not affected
6.4.10 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.