CVE-2023-53660

bpf, cpumap: Handle skb as well when clean up ptr_ring

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

------------[ cut here ]------------ Incorrect XDP memory type (-2128176192) usage WARNING: CPU: 7 PID: 1442 at net/core/xdp.c:405 Modules linked in: CPU: 7 PID: 1442 Comm: kworker/7:0 Tainted: G 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events __cpu_map_entry_free RIP: 0010:__xdp_return+0x1e4/0x4a0 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ? __xdp_return+0x1e4/0x4a0 ...... xdp_return_frame+0x4d/0x150 __cpu_map_entry_free+0xf9/0x230 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK>

The reason for the warning is twofold. One is due to the kthread cpu_map_kthread_run() is stopped prematurely. Another one is __cpu_map_ring_cleanup() doesn't handle skb mode and treats skbs in ptr_ring as XDP frames.

Prematurely-stopped kthread will be fixed by the preceding patch and ptr_ring will be empty when __cpu_map_ring_cleanup() is called. But as the comments in __cpu_map_ring_cleanup() said, handling and freeing skbs in ptr_ring as well to "catch any broken behaviour gracefully".

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.17%Up 0.1 points since Oct 8, 2025

What each source reports

CVE List Score used7.8

bpf, cpumap: Handle skb as well when clean up ptr_ring

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

Record: CVE-2023-53660
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-319447.8

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

Record: EUVD-2025-31944
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v6pf-gqpp-85ff5.5

In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as...

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

Record: GHSA-v6pf-gqpp-85ff
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD7.8

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

Record: CVE-2023-53660
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-536605.5

Record: BELL-CVE-2023-53660
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV7.8

bpf, cpumap: Handle skb as well when clean up ptr_ring

In the Linux kernel, the following vulnerability has been resolved:

bpf, cpumap: Handle skb as well when clean up ptr_ring

The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled:

Record: CVE-2023-53660
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 15 moreShow less

OSVDEBIAN-CVE-2023-536605.5

In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]------------ Incorrect XDP memory type (-2128176192) usage WARNING: CPU: 7 PID: 1442 at net/core/xdp.c:405 Modules linked in: CPU: 7 PID: 1442 Comm: kworker/7:0 Tainted: G 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events __cpu_map_entry_free RIP: 0010:__xdp_return+0x1e4/0x4a0 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ? __xdp_return+0x1e4/0x4a0 ...... xdp_return_frame+0x4d/0x150 __cpu_map_entry_free+0xf9/0x230 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> The reason for the warning is twofold. One is due to the kthread cpu_map_kthread_run() is stopped prematurely. Another one is __cpu_map_ring_cleanup() doesn't handle skb mode and treats skbs in ptr_ring as XDP frames. Prematurely-stopped kthread will be fixed by the preceding patch and ptr_ring will be empty when __cpu_map_ring_cleanup() is called. But as the comments in __cpu_map_ring_cleanup() said, handling and freeing skbs in ptr_ring as well to "catch any broken behaviour gracefully".

Record: DEBIAN-CVE-2023-53660
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:82678.2

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2022:8267
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-536605.6

Record: UBUNTU-CVE-2023-53660
CVSS 4.0: 5.6 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2026-1780516677No score

kernel: Fix of 135 CVEs

atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
ALSA: usb-audio: Use the right limit for PCM OOB check
ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
rcu: Fix rcu_read_unlock() deadloop due to softirq
rcu: Fix racy re-initialization of irq_work causing hangs
RDMA/efa: Fix possible deadlock {CVE-2026-31493}
RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
RDMA/efa: Extend admin timeout error print
RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
net: hinic: fix memory leak when reading function table {CVE-2022-50438}
device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
usbnet: fix memory leak in error case {CVE-2022-49657}
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
bpf: Fix…

Record: CLSA-2026-1780516677
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score