CVE-2023-53426 (GCVE-0-2023-53426)

Vulnerability from cvelistv5 – Published: 2025-09-18 16:04 – Updated: 2026-01-14 19:23
VLAI?
Title
xsk: Fix xsk_diag use-after-free error during socket cleanup
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND. The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ad7219cd8751bd258b9d1e69ae0654ec00f71875 , < 5979985f2d6b565b6cf0f79a62670a2855c0e96c (git)
Affected: 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 , < 6436973164ea5506a495f39e56be5aea375e7832 (git)
Affected: 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 , < 595931912357fa3507e522a7f8a0a76e423c23e4 (git)
Affected: 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 , < 3e019d8a05a38abb5c85d4f1e85fda964610aa14 (git)
Affected: d1579253ffce39986e7a6ab757ac93b2680a665f (git)
Affected: 8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9 (git)
Create a notification for this product.
    Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.15.132 , ≤ 5.15.* (semver)
Unaffected: 6.1.54 , ≤ 6.1.* (semver)
Unaffected: 6.5.4 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:13:38.758691Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:23:08.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_diag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5979985f2d6b565b6cf0f79a62670a2855c0e96c",
              "status": "affected",
              "version": "ad7219cd8751bd258b9d1e69ae0654ec00f71875",
              "versionType": "git"
            },
            {
              "lessThan": "6436973164ea5506a495f39e56be5aea375e7832",
              "status": "affected",
              "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21",
              "versionType": "git"
            },
            {
              "lessThan": "595931912357fa3507e522a7f8a0a76e423c23e4",
              "status": "affected",
              "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21",
              "versionType": "git"
            },
            {
              "lessThan": "3e019d8a05a38abb5c85d4f1e85fda964610aa14",
              "status": "affected",
              "version": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1579253ffce39986e7a6ab757ac93b2680a665f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_diag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.132",
                  "versionStartIncluding": "5.15.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix xsk_diag use-after-free error during socket cleanup\n\nFix a use-after-free error that is possible if the xsk_diag interface\nis used after the socket has been unbound from the device. This can\nhappen either due to the socket being closed or the device\ndisappearing. In the early days of AF_XDP, the way we tested that a\nsocket was not bound to a device was to simply check if the netdevice\npointer in the xsk socket structure was NULL. Later, a better system\nwas introduced by having an explicit state variable in the xsk socket\nstruct. For example, the state of a socket that is on the way to being\nclosed and has been unbound from the device is XSK_UNBOUND.\n\nThe commit in the Fixes tag below deleted the old way of signalling\nthat a socket is unbound, setting dev to NULL. This in the belief that\nall code using the old way had been exterminated. That was\nunfortunately not true as the xsk diagnostics code was still using the\nold way and thus does not work as intended when a socket is going\ndown. Fix this by introducing a test against the state variable. If\nthe socket is in the state XSK_UNBOUND, simply abort the diagnostic\u0027s\nnetlink operation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T16:04:08.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5979985f2d6b565b6cf0f79a62670a2855c0e96c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6436973164ea5506a495f39e56be5aea375e7832"
        },
        {
          "url": "https://git.kernel.org/stable/c/595931912357fa3507e522a7f8a0a76e423c23e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e019d8a05a38abb5c85d4f1e85fda964610aa14"
        }
      ],
      "title": "xsk: Fix xsk_diag use-after-free error during socket cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53426",
    "datePublished": "2025-09-18T16:04:08.192Z",
    "dateReserved": "2025-09-17T14:54:09.743Z",
    "dateUpdated": "2026-01-14T19:23:08.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-09-18T16:04:08.192Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxsk: Fix xsk_diag use-after-free error during socket cleanup\\n\\nFix a use-after-free error that is possible if the xsk_diag interface\\nis used after the socket has been unbound from the device. This can\\nhappen either due to the socket being closed or the device\\ndisappearing. In the early days of AF_XDP, the way we tested that a\\nsocket was not bound to a device was to simply check if the netdevice\\npointer in the xsk socket structure was NULL. Later, a better system\\nwas introduced by having an explicit state variable in the xsk socket\\nstruct. For example, the state of a socket that is on the way to being\\nclosed and has been unbound from the device is XSK_UNBOUND.\\n\\nThe commit in the Fixes tag below deleted the old way of signalling\\nthat a socket is unbound, setting dev to NULL. This in the belief that\\nall code using the old way had been exterminated. That was\\nunfortunately not true as the xsk diagnostics code was still using the\\nold way and thus does not work as intended when a socket is going\\ndown. Fix this by introducing a test against the state variable. If\\nthe socket is in the state XSK_UNBOUND, simply abort the diagnostic\u0027s\\nnetlink operation.\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/xdp/xsk_diag.c\"], \"versions\": [{\"version\": \"ad7219cd8751bd258b9d1e69ae0654ec00f71875\", \"lessThan\": \"5979985f2d6b565b6cf0f79a62670a2855c0e96c\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"18b1ab7aa76bde181bdb1ab19a87fa9523c32f21\", \"lessThan\": \"6436973164ea5506a495f39e56be5aea375e7832\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"18b1ab7aa76bde181bdb1ab19a87fa9523c32f21\", \"lessThan\": \"595931912357fa3507e522a7f8a0a76e423c23e4\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"18b1ab7aa76bde181bdb1ab19a87fa9523c32f21\", \"lessThan\": \"3e019d8a05a38abb5c85d4f1e85fda964610aa14\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"d1579253ffce39986e7a6ab757ac93b2680a665f\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/xdp/xsk_diag.c\"], \"versions\": [{\"version\": \"5.18\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"5.18\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.15.132\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.1.54\", \"lessThanOrEqual\": \"6.1.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.5.4\", \"lessThanOrEqual\": \"6.5.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.6\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.33\", \"versionEndExcluding\": \"5.15.132\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18\", \"versionEndExcluding\": \"6.1.54\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18\", \"versionEndExcluding\": \"6.5.4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18\", \"versionEndExcluding\": \"6.6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16.19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.17.2\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5979985f2d6b565b6cf0f79a62670a2855c0e96c\"}, {\"url\": \"https://git.kernel.org/stable/c/6436973164ea5506a495f39e56be5aea375e7832\"}, {\"url\": \"https://git.kernel.org/stable/c/595931912357fa3507e522a7f8a0a76e423c23e4\"}, {\"url\": \"https://git.kernel.org/stable/c/3e019d8a05a38abb5c85d4f1e85fda964610aa14\"}], \"title\": \"xsk: Fix xsk_diag use-after-free error during socket cleanup\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:13:38.758691Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-01-14T19:13:34.565Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53426\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-09-17T14:54:09.743Z\", \"datePublished\": \"2025-09-18T16:04:08.192Z\", \"dateUpdated\": \"2025-09-18T16:04:08.192Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.