CVE-2023-53559

EUVD-2025-32314

04.10.2025, 16:15

In the Linux kernel, the following vulnerability has been resolved:

ip_vti: fix potential slab-use-after-free in decode_session6

When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	3.19.1 ≤ 𝑥 < 4.14.324
linux	linux_kernel	4.15 ≤ 𝑥 < 4.19.293
linux	linux_kernel	4.20 ≤ 𝑥 < 5.4.255
linux	linux_kernel	5.5 ≤ 𝑥 < 5.10.192
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.128
linux	linux_kernel	5.16 ≤ 𝑥 < 6.1.47
linux	linux_kernel	6.2 ≤ 𝑥 < 6.4.12
linux	linux_kernel	3.19
linux	linux_kernel	3.19:rc7
linux	linux_kernel	6.5:rc1
linux	linux_kernel	6.5:rc2
linux	linux_kernel	6.5:rc3
linux	linux_kernel	6.5:rc4
linux	linux_kernel	6.5:rc5
linux	linux_kernel	6.5:rc6

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.148-1 fixed
bookworm (security)	6.1.153-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.237-1 fixed
forky	6.16.9-1 fixed
sid	6.16.9-1 fixed
trixie	6.12.43-1 fixed
trixie (security)	6.12.48-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed

dlm-kmp-default

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed

gfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed

kernel-64kb

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.18.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.18.1 fixed

kernel-default

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-default-base

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1.150600.12.34.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1.150700.17.15.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1.150600.12.34.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1.150700.17.15.1 fixed
suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1.150200.9.131.4 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2.150300.18.134.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1.150400.24.94.2 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1.150500.6.61.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1.150600.12.34.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1.150700.17.15.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

kernel-docs

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.3 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-macros

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-obs-build

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-preempt

suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed

kernel-source

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-source-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.18.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.18.1 fixed

kernel-syms

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

kernel-syms-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.18.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.55.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.18.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.22.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.78.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.22.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed

reiserfs-kmp-default

suse enterprise server 15 SP2	5.3.18-150200.24.242.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.226.2 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.184.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.127.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bpftool

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:7.3.0-427.13.1.el9_4 fixed

kernel

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-64k

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-devel

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-devel-matched

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-modules

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-debug-modules-extra

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-devel

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-devel-matched

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-modules

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-64k-modules-extra

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-abi-stablelists

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-core

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug-core

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug-devel

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug-devel-matched

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-debug-modules

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-debug-modules-extra

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-debug-uki-virt

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-devel

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-devel-matched

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-doc

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-modules

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-modules-extra

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-rt

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-devel

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-kvm

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-modules

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-debug-modules-extra

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-devel

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-kvm

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-modules

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-rt-modules-extra

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-tools

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-tools-libs

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-tools-libs-devel

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-uki-virt

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-zfcpdump

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-zfcpdump-core

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-zfcpdump-devel

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-zfcpdump-devel-matched

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-zfcpdump-modules

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

kernel-zfcpdump-modules-core

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

kernel-zfcpdump-modules-extra

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

libperf

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

perf

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

python3-perf

RHEL 8	0:4.18.0-553.el8_10 fixed
RHEL 9	0:5.14.0-427.13.1.el9_4 fixed

rtla

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

RHEL 9

0:5.14.0-427.13.1.el9_4

fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068

https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7a

https://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0b

https://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9

https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15ca

https://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1d

https://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbd

https://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32