CVE-2023-53559

ip_vti: fix potential slab-use-after-free in decode_session6

State: Published
Severity: 7.8 High
Published: Oct 4, 2025
Updated: Aug 5, 2026
Reserved: Oct 4, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ip_vti: fix potential slab-use-after-free in decode_session6

When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f855691975bb06373a98711e4cfe2c224244b536 to before 82fb41c5de243e7dfa90f32ca58e35adaff56c1dAffected f855691975bb06373a98711e4cfe2c224244b536 to before 7dfe23659f3677c08a60a0056cda2d91a79c15caAffected f855691975bb06373a98711e4cfe2c224244b536 to before d34c30442d5e53a33cde79ca163320dbe2432cbdAffected f855691975bb06373a98711e4cfe2c224244b536 to before 0b4d69539fdea138af2befe08893850c89248068Affected f855691975bb06373a98711e4cfe2c224244b536 to before e1e04cc2ef2c0c0866c19f5627149a76c2baae32Affected f855691975bb06373a98711e4cfe2c224244b536 to before 2b05bf5dc437f7891dd409a3eaf5058459391c7aAffected f855691975bb06373a98711e4cfe2c224244b536 to before 78e397a43e1c47321a4679cc49a6c4530bf820b9Affected f855691975bb06373a98711e4cfe2c224244b536 to before 6018a266279b1a75143c7c0804dd08a5fc4c3e0bAffected
LinuxLinux	3.19Affected before 3.19Not affected 4.14.324 through 4.14.Not affected 4.19.293 through 4.19.Not affected 5.4.255 through 5.4.Not affected 5.10.192 through 5.10.Not affected 5.15.128 through 5.15.Not affected 6.1.47 through 6.1.Not affected 6.4.12 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

f855691975bb06373a98711e4cfe2c224244b536 to before 82fb41c5de243e7dfa90f32ca58e35adaff56c1dAffected
f855691975bb06373a98711e4cfe2c224244b536 to before 7dfe23659f3677c08a60a0056cda2d91a79c15caAffected
f855691975bb06373a98711e4cfe2c224244b536 to before d34c30442d5e53a33cde79ca163320dbe2432cbdAffected
f855691975bb06373a98711e4cfe2c224244b536 to before 0b4d69539fdea138af2befe08893850c89248068Affected
f855691975bb06373a98711e4cfe2c224244b536 to before e1e04cc2ef2c0c0866c19f5627149a76c2baae32Affected
f855691975bb06373a98711e4cfe2c224244b536 to before 2b05bf5dc437f7891dd409a3eaf5058459391c7aAffected
f855691975bb06373a98711e4cfe2c224244b536 to before 78e397a43e1c47321a4679cc49a6c4530bf820b9Affected
f855691975bb06373a98711e4cfe2c224244b536 to before 6018a266279b1a75143c7c0804dd08a5fc4c3e0bAffected

LinuxLinux

3.19Affected
before 3.19Not affected
4.14.324 through 4.14.*Not affected
4.19.293 through 4.19.*Not affected
5.4.255 through 5.4.*Not affected
5.10.192 through 5.10.*Not affected
5.15.128 through 5.15.*Not affected
6.1.47 through 6.1.*Not affected
6.4.12 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.