CVE-2023-53432

firewire: net: fix use after free in fwnet_finish_incoming_packet()

State: Published
Severity: 8.8 High
Published: Sep 18, 2025
Updated: Aug 5, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	c76acec6d55107b652a37c90b36c00bc8b04dabb to before 2ea70379e4f4efa95c9daa7f3f9bdd4d40aec927Affected c76acec6d55107b652a37c90b36c00bc8b04dabb to before 9040adc38cf6bfbb77034d558ac2c52f70d840acAffected c76acec6d55107b652a37c90b36c00bc8b04dabb to before 9860921ab4521252dc39bb21b9c936bd09a00982Affected c76acec6d55107b652a37c90b36c00bc8b04dabb to before 3ff256751a2853e1ffaa36958ff933ccc98c6cb5Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.15.128 through 5.15.Not affected 6.1.47 through 6.1.Not affected 6.4.12 through 6.4.*Not affected 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.