{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-53107 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53107 is a high-severity use after free vulnerability in Linux kernel, published on 2 May 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-53107 and fix it if it is affected.\n\nWhat it is: CVE-2023-53107 is a high-severity use after free vulnerability in Linux kernel, published on 2 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-53107 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53107/ (Markdown: https://insights.sbomify.com/CVE-2023-53107/index.md)","id":"CVE-2023-53107","markdown":"https://insights.sbomify.com/CVE-2023-53107/index.md","name":"CVE-2023-53107","record":{"aliases":["BELL-CVE-2023-53107","DEBIAN-CVE-2023-53107","GHSA-wmmr-m98c-g94f","RHSA-2025:8133","RHSA-2025:8134","RHSA-2025:8399","UBUNTU-CVE-2023-53107"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel's veth driver allows attackers to cause denial of service or potentially execute code via crafted network packets.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: Fix use after free in XDP_REDIRECT\n\nCommit 718a18a0c8a6 (\"veth: Rework veth_xdp_rcv_skb in order\nto accept non-linear skb\") introduced a bug where it tried to\nuse pskb_expand_head() if the headroom was less than\nXDP_PACKET_HEADROOM.  This however uses kmalloc to expand the head,\nwhich will later allow consume_skb() to free the skb while is it still\nin use by AF_XDP.\n\nPreviously if the headroom was less than XDP_PACKET_HEADROOM we\ncontinued on to allocate a new skb from pages so this restores that\nbehavior.\n\nBUG: KASAN: use-after-free in __xsk_rcv+0x18d/0x2c0\nRead of size 78 at addr ffff888976250154 by task napi/iconduit-g/148640\n\nCPU: 5 PID: 148640 Comm: napi/iconduit-g Kdump: loaded Tainted: G           O       6.1.4-cloudflare-kasan-2023.1.2 #1\nHardware name: Quanta Computer Inc. QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018\nCall Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  print_report+0x170/0x473\n  ? __xsk_rcv+0x18d/0x2c0\n  kasan_report+0xad/0x130\n  ? __xsk_rcv+0x18d/0x2c0\n  kasan_check_range+0x149/0x1a0\n  memcpy+0x20/0x60\n  __xsk_rcv+0x18d/0x2c0\n  __xsk_map_redirect+0x1f3/0x490\n  ? veth_xdp_rcv_skb+0x89c/0x1ba0 [veth]\n  xdp_do_redirect+0x5ca/0xd60\n  veth_xdp_rcv_skb+0x935/0x1ba0 [veth]\n  ? __netif_receive_skb_list_core+0x671/0x920\n  ? veth_xdp+0x670/0x670 [veth]\n  veth_xdp_rcv+0x304/0xa20 [veth]\n  ? do_xdp_generic+0x150/0x150\n  ? veth_xdp_rcv_one+0xde0/0xde0 [veth]\n  ? _raw_spin_lock_bh+0xe0/0xe0\n  ? newidle_balance+0x887/0xe30\n  ? __perf_event_task_sched_in+0xdb/0x800\n  veth_poll+0x139/0x571 [veth]\n  ? veth_xdp_rcv+0xa20/0xa20 [veth]\n  ? _raw_spin_unlock+0x39/0x70\n  ? finish_task_switch.isra.0+0x17e/0x7d0\n  ? __switch_to+0x5cf/0x1070\n  ? __schedule+0x95b/0x2640\n  ? io_schedule_timeout+0x160/0x160\n  __napi_poll+0xa1/0x440\n  napi_threaded_poll+0x3d1/0x460\n  ? __napi_poll+0x440/0x440\n  ? __kthread_parkme+0xc6/0x1f0\n  ? __napi_poll+0x440/0x440\n  kthread+0x2a2/0x340\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x22/0x30\n  \u003c/TASK\u003e\n\nFreed by task 148640:\n  kasan_save_stack+0x23/0x50\n  kasan_set_track+0x21/0x30\n  kasan_save_free_info+0x2a/0x40\n  ____kasan_slab_free+0x169/0x1d0\n  slab_free_freelist_hook+0xd2/0x190\n  __kmem_cache_free+0x1a1/0x2f0\n  skb_release_data+0x449/0x600\n  consume_skb+0x9f/0x1c0\n  veth_xdp_rcv_skb+0x89c/0x1ba0 [veth]\n  veth_xdp_rcv+0x304/0xa20 [veth]\n  veth_poll+0x139/0x571 [veth]\n  __napi_poll+0xa1/0x440\n  napi_threaded_poll+0x3d1/0x460\n  kthread+0x2a2/0x340\n  ret_from_fork+0x22/0x30\n\nThe buggy address belongs to the object at ffff888976250000\n  which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 340 bytes inside of\n  2048-byte region [ffff888976250000, ffff888976250800)\n\nThe buggy address belongs to the physical page:\npage:00000000ae18262a refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x976250\nhead:00000000ae18262a order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff)\nraw: 002ffff800010200 0000000000000000 dead000000000122 ffff88810004cf00\nraw: 0000000000000000 0000000080080008 00000002ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n  ffff888976250000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff888976250080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003e ffff888976250100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                  ^\n  ffff888976250180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff888976250200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb","ecosystems":["Red Hat:rhel_e4s:9.2::baseos","Red Hat:rhel_eus:9.2::appstream","Red Hat:rhel_eus:9.2::baseos","Red Hat:rhel_eus:9.2::crb","Red Hat:rhel_eus:9.2::nfv","Red Hat:rhel_eus:9.2::realtime"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"veth: Fix use after free in XDP_REDIRECT","id":"CVE-2023-53107","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2023"},"n_packages":132,"n_references":3,"next":{"headline":"net/iucv: Fix size of interrupt data","id":"CVE-2023-53108"},"packages":[{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_104_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_104_1","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_104_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_104_1-debuginfo","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_104_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_104_1-debugsource","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_117_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_117_1","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_117_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_117_1-debuginfo","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_117_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_117_1-debugsource","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-12.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-12.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1-debuginfo","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-12.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1-debugsource","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-8.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_79_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_79_1","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-8.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_79_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_79_1-debuginfo","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-8.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_79_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_79_1-debugsource","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-6.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_92_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_92_1","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-6.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_92_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_92_1-debuginfo","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","fixed":["0:1-6.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_92_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_92_1-debugsource","source":"RHSA-2025:8399"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:7.0.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"bpftool-debuginfo","purl":"pkg:rpm/redhat/bpftool-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debug-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel","purl":"pkg:rpm/redhat/kernel-64k-debug-devel","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-debug-devel-matched","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel","purl":"pkg:rpm/redhat/kernel-64k-devel","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-devel-matched","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-debug-devel-matched","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-aarch64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-aarch64","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-ppc64le","purl":"pkg:rpm/redhat/kernel-debuginfo-common-ppc64le","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-s390x","purl":"pkg:rpm/redhat/kernel-debuginfo-common-s390x","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-devel-matched","purl":"pkg:rpm/redhat/kernel-devel-matched","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-debuginfo","purl":"pkg:rpm/redhat/kernel-tools-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-debuginfo","purl":"pkg:rpm/redhat/kernel-zfcpdump-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-devel","purl":"pkg:rpm/redhat/kernel-zfcpdump-devel","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-devel-matched","purl":"pkg:rpm/redhat/kernel-zfcpdump-devel-matched","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/redhat/perf","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"perf-debuginfo","purl":"pkg:rpm/redhat/perf-debuginfo","source":"RHSA-2025:8133"},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","fixed":["0:5.14.0-284.118.1.el9_2"],"introduced":["0"],"last_affected":[],"package":"python3-perf-debuginfo","purl":"pkg:rpm/redhat/python3-perf-debuginfo","source":"RHSA-2025:8133"}],"prev":{"headline":"nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition","id":"CVE-2023-53106"},"products":["Linux"],"published":"2025-05-02","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's veth driver allows attackers to cause denial of service or potentially execute code via crafted network packets.","url":"https://insights.sbomify.com/CVE-2023-53107/"}