Riskcovery

CVE-2023-53669

tcp: fix skb_copy_ubufs() vs BIG TCP

State
Published
Severity
7.8 High
Published
Oct 7, 2025
Updated
Oct 15, 2026
Reserved
Oct 7, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix skb_copy_ubufs() vs BIG TCP

David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB.

skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages.

This assumption broke when BIG TCP was able to put up to 512 KB per skb.

We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000.

A solution is to use higher order pages if needed.

v2: add missing __GFP_COMP, or we leak memory.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7c4e983c4f3cf94fcd879730c6caa877e0768a4d to before 7fa93e39fbb0566019c388a8038a4d58552e0910Affected
  • 7c4e983c4f3cf94fcd879730c6caa877e0768a4d to before 3c77a377877acbaf03cd7caa21d3644a5dd16301Affected
  • 7c4e983c4f3cf94fcd879730c6caa877e0768a4d to before 9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328fAffected
  • 7c4e983c4f3cf94fcd879730c6caa877e0768a4d to before 7e692df3933628d974acb9f5b334d2b3e885e2a6Affected
LinuxLinux
  • 5.19Affected
  • before 5.19Not affected
  • 6.1.29 through 6.1.*Not affected
  • 6.2.16 through 6.2.*Not affected
  • 6.3.3 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.