CVE-2023-53600

tunnels: fix kasan splat when generating ipv4 pmtu error

9.1 CriticalFix available

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..]

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

0.30%Up 0.3 points since Oct 5, 2025

What each source reports

CVE List Score used 9.1

tunnels: fix kasan splat when generating ipv4 pmtu error

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: CVE-2023-53600
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2025-32264 9.1

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: EUVD-2025-32264
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qh3w-rq3m-fpq5 7.1

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat...

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: GHSA-qh3w-rq3m-fpq5
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 9.1

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: CVE-2023-53600
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2023-53600 7.1

Record: BELL-CVE-2023-53600
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV 9.1

tunnels: fix kasan splat when generating ipv4 pmtu error

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix kasan splat when generating ipv4 pmtu error

If we try to emit an icmp error in response to a nonliner skb, we get

ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: CVE-2023-53600
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 15 moreShow less

OSVDEBIAN-CVE-2023-53600 7.1

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Record: DEBIAN-CVE-2023-53600
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-53600 6.3

Record: UBUNTU-CVE-2023-53600
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1773139548 No score

kernel: Fix of 78 CVEs

fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
wifi: mac80211: check for station first in client probe {CVE-2023-53588}
bonding: do not assume skb mac_header is set {CVE-2023-53601}
drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
md/raid10: fix memleak of md thread {CVE-2023-54294}
usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
xfs: do not propagate ENODATA…

Record: CLSA-2026-1773139548
Updated: 2026-11-02

OSVCLSA-2026-1782145985 No score

kernel: Fix of 62 CVEs

libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
kyber: fix out of bounds access when preempted {CVE-2021-46984}
can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
tls: separate no-async decryption request handling from async {CVE-2024-58240}
ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
RDMA/umad: Reject negative data_len in…

Record: CLSA-2026-1782145985
Updated: 2026-11-02

OSVCLSA-2026-1782146775 No score

kernel: Fix of 58 CVEs

libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
ice: Fix memory corruption in VF driver {CVE-2022-49722}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
netfilter: nf_conntrack_helper: pass helper to…

Record: CLSA-2026-1782146775
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1 No score