{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53439", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-17T14:54:09.751Z", "datePublished": "2025-09-18T16:04:17.166Z", "dateUpdated": "2026-05-11T19:45:00.352Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T19:45:00.352Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb_partial_csum_set() fix against transport header magic value\n\nskb->transport_header uses the special 0xFFFF value\nto mark if the transport header was set or not.\n\nWe must prevent callers to accidentaly set skb->transport_header\nto 0xFFFF. Note that only fuzzers can possibly do this today.\n\nsyzbot reported:\n\nWARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 skb_transport_offset include/linux/skbuff.h:2956 [inline]\nWARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103\nModules linked in:\nCPU: 0 PID: 2340 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023\nRIP: 0010:skb_transport_header include/linux/skbuff.h:2847 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:2956 [inline]\nRIP: 0010:virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103\nCode: 41 39 df 0f 82 c3 04 00 00 48 8b 7c 24 10 44 89 e6 e8 08 6e 59 ff 48 85 c0 74 54 e8 ce 36 7e fc e9 37 f8 ff ff e8 c4 36 7e fc <0f> 0b e9 93 f8 ff ff 44 89 f7 44 89 e6 e8 32 38 7e fc 45 39 e6 0f\nRSP: 0018:ffffc90004497880 EFLAGS: 00010293\nRAX: ffffffff84fea55c RBX: 000000000000ffff RCX: ffff888120be2100\nRDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff\nRBP: ffffc90004497990 R08: ffffffff84fe9de5 R09: 0000000000000034\nR10: ffffea00048ebd80 R11: 0000000000000034 R12: ffff88811dc2d9c8\nR13: dffffc0000000000 R14: ffff88811dc2d9ae R15: 1ffff11023b85b35\nFS: 00007f9211a59700(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200002c0 CR3: 00000001215a5000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\npacket_snd net/packet/af_packet.c:3076 [inline]\npacket_sendmsg+0x4590/0x61a0 net/packet/af_packet.c:3115\nsock_sendmsg_nosec net/socket.c:724 [inline]\nsock_sendmsg net/socket.c:747 [inline]\n__sys_sendto+0x472/0x630 net/socket.c:2144\n__do_sys_sendto net/socket.c:2156 [inline]\n__se_sys_sendto net/socket.c:2152 [inline]\n__x64_sys_sendto+0xe5/0x100 net/socket.c:2152\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f9210c8c169\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f9211a59168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f9210dabf80 RCX: 00007f9210c8c169\nRDX: 000000000000ffed RSI: 00000000200000c0 RDI: 0000000000000003\nRBP: 00007f9210ce7ca1 R08: 0000000020000540 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffe135d65cf R14: 00007f9211a59300 R15: 0000000000022000" } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "66e4c8d950083df8e12981babca788e1635c92b6", "lessThan": "3e785c8deb046305c61b9fa02265d0cb900c4a45", "status": "affected", "versionType": "git" }, { "version": "66e4c8d950083df8e12981babca788e1635c92b6", "lessThan": "70a76d6816148819d0464f71aafa126c84826628", "status": "affected", "versionType": "git" }, { "version": "66e4c8d950083df8e12981babca788e1635c92b6", "lessThan": "424f8416bb39936df6365442d651ee729b283460", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3e785c8deb046305c61b9fa02265d0cb900c4a45" }, { "url": "https://git.kernel.org/stable/c/70a76d6816148819d0464f71aafa126c84826628" }, { "url": "https://git.kernel.org/stable/c/424f8416bb39936df6365442d651ee729b283460" } ], "title": "net: skb_partial_csum_set() fix against transport header magic value", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2023-53439", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2026-01-14T19:17:30.734680Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:23:10.642Z" } } ] } }