CVE-2023-53338 lwt: Fix return values of BPF xmit ops
A use-after-free vulnerability in the Linux kernel's BPF xmit operations allows attackers to cause kernel crashes or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53338?
CVE-2023-53338 is a critical use after free vulnerability in Linux kernel, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
lwt: Fix return values of BPF xmit ops
BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes.
To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.
Weakness: CWE-416
Which versions are affected by CVE-2023-53338?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53338?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-53338 being exploited?
There is no known exploitation of CVE-2023-53338 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53338, DEBIAN-CVE-2023-53338, GHSA-wqfp-wxf7-9vr7, UBUNTU-CVE-2023-53338.