CVE-2023-53559 ip_vti: fix potential slab-use-after-free in decode_session6
A use-after-free vulnerability in the Linux kernel's ip_vti module allows attackers to cause denial of service or execute code when using specific queueing disciplines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53559?
CVE-2023-53559 is a high-severity use after free vulnerability in Linux kernel, published on 4 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
Weakness: CWE-416
Which versions are affected by CVE-2023-53559?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53559?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-53559 being exploited?
There is no known exploitation of CVE-2023-53559 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53559, DEBIAN-CVE-2023-53559, GHSA-6v4x-gf5x-r6w5, UBUNTU-CVE-2023-53559.