CVE-2023-53585

bpf: reject unhashed sockets in bpf_sk_assign

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

That is, the sk is not consumed by bpf_sk_assign. The function therefore needs to make sure that sk lives long enough to be consumed from __inet_lookup_skb. The path through the stack for a TCPv4 packet is roughly:

netif_receive_skb_core: takes RCU read lock __netif_receive_skb_core: sch_handle_ingress: tcf_classify: bpf_sk_assign() deliver_ptype_list_skb: deliver_skb: ip_packet_type->func == ip_rcv: ip_rcv_core: ip_rcv_finish_core: dst_input: ip_local_deliver: ip_local_deliver_finish: ip_protocol_deliver_rcu: tcp_v4_rcv: __inet_lookup_skb: skb_steal_sock

The existing helper takes advantage of the fact that everything happens in the same RCU critical section: for sockets with SOCK_RCU_FREE set bpf_sk_assign never takes a reference. skb_steal_sock then checks SOCK_RCU_FREE again and does sock_put if necessary.

This approach assumes that SOCK_RCU_FREE is never set on a sk between bpf_sk_assign and skb_steal_sock, but this invariant is violated by unhashed UDP sockets. A new UDP socket is created in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only added in udp_lib_get_port() which happens when a socket is bound.

When bpf_sk_assign was added it wasn't possible to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712 ("sock_map: Lift socket state restriction for datagram sockets"), but the helper wasn't adjusted accordingly. The following sequence of events will therefore lead to a refcount leak:

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Oct 5, 2025

What each source reports

NVD Score used5.5

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: CVE-2023-53585
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

CVE ListNo score

bpf: reject unhashed sockets in bpf_sk_assign

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: CVE-2023-53585
Updated: 2026-11-02

EUVDEUVD-2025-32324No score

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: EUVD-2025-32324
Updated: 2026-11-02

GitHub AdvisoriesGHSA-39wr-crm4-gxmv5.5

In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets...

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: GHSA-39wr-crm4-gxmv
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-535855.5

Record: BELL-CVE-2023-53585
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-535855.5

In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpf_sk_assign The semantics for bpf_sk_assign are as follows: sk = some_lookup_func() bpf_sk_assign(skb, sk) bpf_sk_release(sk) That is, the sk is not consumed by bpf_sk_assign. The function therefore needs to make sure that sk lives long enough to be consumed from __inet_lookup_skb. The path through the stack for a TCPv4 packet is roughly: netif_receive_skb_core: takes RCU read lock __netif_receive_skb_core: sch_handle_ingress: tcf_classify: bpf_sk_assign() deliver_ptype_list_skb: deliver_skb: ip_packet_type->func == ip_rcv: ip_rcv_core: ip_rcv_finish_core: dst_input: ip_local_deliver: ip_local_deliver_finish: ip_protocol_deliver_rcu: tcp_v4_rcv: __inet_lookup_skb: skb_steal_sock The existing helper takes advantage of the fact that everything happens in the same RCU critical section: for sockets with SOCK_RCU_FREE set bpf_sk_assign never takes a reference. skb_steal_sock then checks SOCK_RCU_FREE again and does sock_put if necessary. This approach assumes that SOCK_RCU_FREE is never set on a sk between bpf_sk_assign and skb_steal_sock, but this invariant is violated by unhashed UDP sockets. A new UDP socket is created in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only added in udp_lib_get_port() which happens when a socket is bound. When bpf_sk_assign was added it wasn't possible to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712 ("sock_map: Lift socket state restriction for datagram sockets"), but the helper wasn't adjusted accordingly. The following sequence of events will therefore lead to a refcount leak: 1. Add socket(AF_INET, SOCK_DGRAM) to a sockmap. 2. Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount. 3. bind() or connect() the socket, setting SOCK_RCU_FREE. 4. skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE. 5. tcp_v4_rcv() skips sock_put(). Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: DEBIAN-CVE-2023-53585
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 15 moreShow less

OSVRHSA-2020:44317.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2020:4431
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-535855.6

Record: UBUNTU-CVE-2023-53585
CVSS 4.0: 5.6 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1779987841No score

kernel: Fix of 110 CVEs

smb: client: reject userspace cifs.spnego descriptions
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
driver core: fix resource leak in device_add() {CVE-2023-53594}
wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
cpufreq: exit() callback is optional {CVE-2024-38615}
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
usb: ulpi: fix memory leak on ulpi_register() error paths
usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
bnxt: Do not read past the end of test names {CVE-2023-53010}
dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
cifs: Fix oops due to uncleared server->smbd_conn…

Record: CLSA-2026-1779987841
Updated: 2026-11-02

OSVNo score

bpf: reject unhashed sockets in bpf_sk_assign

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpf_sk_assign

The semantics for bpf_sk_assign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
Pull socket out of sockmap and bpf_sk_assign it. Since SOCK_RCU_FREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCK_RCU_FREE.
skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE.
tcp_v4_rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign().

Record: CVE-2023-53585
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score