{"id":"CVE-2023-52991","state":"PUBLISHED","title":"net: fix NULL pointer in skb_segment_list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer in skb_segment_list\n\nCommit 3a1296a38d0c (\"net: Support GRO/GSO fraglist chaining.\")\nintroduced UDP listifyed GRO. The segmentation relies on frag_list being\nuntouched when passing through the network stack. This assumption can be\nbroken sometimes, where frag_list itself gets pulled into linear area,\nleaving frag_list being NULL. When this happens it can trigger\nfollowing NULL pointer dereference, and panic the kernel. Reverse the\ntest condition should fix it.\n\n[19185.577801][    C1] BUG: kernel NULL pointer dereference, address:\n...\n[19185.663775][    C1] RIP: 0010:skb_segment_list+0x1cc/0x390\n...\n[19185.834644][    C1] Call Trace:\n[19185.841730][    C1]  <TASK>\n[19185.848563][    C1]  __udp_gso_segment+0x33e/0x510\n[19185.857370][    C1]  inet_gso_segment+0x15b/0x3e0\n[19185.866059][    C1]  skb_mac_gso_segment+0x97/0x110\n[19185.874939][    C1]  __skb_gso_segment+0xb2/0x160\n[19185.883646][    C1]  udp_queue_rcv_skb+0xc3/0x1d0\n[19185.892319][    C1]  udp_unicast_rcv_skb+0x75/0x90\n[19185.900979][    C1]  ip_protocol_deliver_rcu+0xd2/0x200\n[19185.910003][    C1]  ip_local_deliver_finish+0x44/0x60\n[19185.918757][    C1]  __netif_receive_skb_one_core+0x8b/0xa0\n[19185.927834][    C1]  process_backlog+0x88/0x130\n[19185.935840][    C1]  __napi_poll+0x27/0x150\n[19185.943447][    C1]  net_rx_action+0x27e/0x5f0\n[19185.951331][    C1]  ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core]\n[19185.960848][    C1]  __do_softirq+0xbc/0x25d\n[19185.968607][    C1]  irq_exit_rcu+0x83/0xb0\n[19185.976247][    C1]  common_interrupt+0x43/0xa0\n[19185.984235][    C1]  asm_common_interrupt+0x22/0x40\n...\n[19186.094106][    C1]  </TASK>","publishedAt":"2025-03-27T16:43:26.991Z","updatedAt":"2026-08-05T09:12:18.633Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"6446369fb9f083ce032448c5047da08e298b22e6","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"046de74f9af92ae9ffce75fa22a1795223f4fb54","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"888dad6f3e85e3b2f8389bd6478f181efc72534d","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"876e8ca8366735a604bac86ff7e2732fc9d85d2d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.167","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.92","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.10","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]}],"references":["https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6","https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54","https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d","https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/52xxx/CVE-2023-52991.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52991","state":"PUBLISHED","datePublished":"2025-03-27T16:43:26.991Z","dateUpdated":"2026-08-05T09:12:18.633Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-03-27T16:40:15.741Z"},"containers":{"cna":{"title":"net: fix NULL pointer in skb_segment_list","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer in skb_segment_list\n\nCommit 3a1296a38d0c (\"net: Support GRO/GSO fraglist chaining.\")\nintroduced UDP listifyed GRO. The segmentation relies on frag_list being\nuntouched when passing through the network stack. This assumption can be\nbroken sometimes, where frag_list itself gets pulled into linear area,\nleaving frag_list being NULL. When this happens it can trigger\nfollowing NULL pointer dereference, and panic the kernel. Reverse the\ntest condition should fix it.\n\n[19185.577801][    C1] BUG: kernel NULL pointer dereference, address:\n...\n[19185.663775][    C1] RIP: 0010:skb_segment_list+0x1cc/0x390\n...\n[19185.834644][    C1] Call Trace:\n[19185.841730][    C1]  <TASK>\n[19185.848563][    C1]  __udp_gso_segment+0x33e/0x510\n[19185.857370][    C1]  inet_gso_segment+0x15b/0x3e0\n[19185.866059][    C1]  skb_mac_gso_segment+0x97/0x110\n[19185.874939][    C1]  __skb_gso_segment+0xb2/0x160\n[19185.883646][    C1]  udp_queue_rcv_skb+0xc3/0x1d0\n[19185.892319][    C1]  udp_unicast_rcv_skb+0x75/0x90\n[19185.900979][    C1]  ip_protocol_deliver_rcu+0xd2/0x200\n[19185.910003][    C1]  ip_local_deliver_finish+0x44/0x60\n[19185.918757][    C1]  __netif_receive_skb_one_core+0x8b/0xa0\n[19185.927834][    C1]  process_backlog+0x88/0x130\n[19185.935840][    C1]  __napi_poll+0x27/0x150\n[19185.943447][    C1]  net_rx_action+0x27e/0x5f0\n[19185.951331][    C1]  ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core]\n[19185.960848][    C1]  __do_softirq+0xbc/0x25d\n[19185.968607][    C1]  irq_exit_rcu+0x83/0xb0\n[19185.976247][    C1]  common_interrupt+0x43/0xa0\n[19185.984235][    C1]  asm_common_interrupt+0x22/0x40\n...\n[19186.094106][    C1]  </TASK>"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"6446369fb9f083ce032448c5047da08e298b22e6","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"046de74f9af92ae9ffce75fa22a1795223f4fb54","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"888dad6f3e85e3b2f8389bd6478f181efc72534d","versionType":"git"},{"version":"3a1296a38d0cf62bffb9a03c585cbd5dbf15d596","status":"affected","lessThan":"876e8ca8366735a604bac86ff7e2732fc9d85d2d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.167","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.92","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.10","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6"},{"url":"https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54"},{"url":"https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d"},{"url":"https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The crash occurs on the inbound UDP softirq path (udp_queue_rcv_skb → __skb_gso_segment → __udp_gso_segment → skb_segment_list) while processing packets received from the network, as shown in the mlx5 NIC call trace; a remote peer can deliver the triggering UDP datagrams.\nAC:L - On a realistic high-performance UDP deployment with rx-gro-list and datapath hooks that pull frag_list (BPF/NAT, as later fraglist fixes document), the attacker only needs to send a burst of aggregatable UDP packets to the listening service and can trigger the NULL deref reliably.\nPR:N - The vulnerable path runs during unauthenticated UDP receive/delivery before any application-level credentials are checked; the attacker needs no local account or capabilities on the target.\nUI:N - Exploitation requires only attacker-sent UDP packets; no victim user action such as mounting a filesystem or opening a file is needed.\nS:U - Impact is confined to the host kernel (oops/panic DoS) and does not cross a VM, IOMMU, or other security authority boundary.\nC:N - The bug is a pure NULL pointer dereference of frag_list with no out-of-bounds read or UAF object control that would disclose memory.\nI:N - The faulting access is a NULL dereference crash only; it does not provide a memory write or control-flow hijack primitive.\nA:H - Dereferencing NULL list_skb in skb_segment_list causes a kernel oops/panic, fully disrupting system availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:12:18.633Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-52991","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:08:20.181820Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","lang":"en","type":"CWE","description":"CWE-476 NULL Pointer Dereference"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T20:17:04.316Z"}}]}}}