{"id":"CVE-2023-53354","state":"PUBLISHED","title":"skbuff: skb_segment, Call zero copy functions before using skbuff frags","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nskbuff: skb_segment, Call zero copy functions before using skbuff frags\n\nCommit bf5c25d60861 (\"skbuff: in skb_segment, call zerocopy functions\nonce per nskb\") added the call to zero copy functions in skb_segment().\nThe change introduced a bug in skb_segment() because skb_orphan_frags()\nmay possibly change the number of fragments or allocate new fragments\naltogether leaving nrfrags and frag to point to the old values. This can\ncause a panic with stacktrace like the one below.\n\n[  193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc\n[  193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G           O      5.15.123+ #26\n[  193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0\n[  194.021892] Call Trace:\n[  194.027422]  <TASK>\n[  194.072861]  tcp_gso_segment+0x107/0x540\n[  194.082031]  inet_gso_segment+0x15c/0x3d0\n[  194.090783]  skb_mac_gso_segment+0x9f/0x110\n[  194.095016]  __skb_gso_segment+0xc1/0x190\n[  194.103131]  netem_enqueue+0x290/0xb10 [sch_netem]\n[  194.107071]  dev_qdisc_enqueue+0x16/0x70\n[  194.110884]  __dev_queue_xmit+0x63b/0xb30\n[  194.121670]  bond_start_xmit+0x159/0x380 [bonding]\n[  194.128506]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.131787]  __dev_queue_xmit+0x8a0/0xb30\n[  194.138225]  macvlan_start_xmit+0x4f/0x100 [macvlan]\n[  194.141477]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.144622]  sch_direct_xmit+0xe3/0x280\n[  194.147748]  __dev_queue_xmit+0x54a/0xb30\n[  194.154131]  tap_get_user+0x2a8/0x9c0 [tap]\n[  194.157358]  tap_sendmsg+0x52/0x8e0 [tap]\n[  194.167049]  handle_tx_zerocopy+0x14e/0x4c0 [vhost_net]\n[  194.173631]  handle_tx+0xcd/0xe0 [vhost_net]\n[  194.176959]  vhost_worker+0x76/0xb0 [vhost]\n[  194.183667]  kthread+0x118/0x140\n[  194.190358]  ret_from_fork+0x1f/0x30\n[  194.193670]  </TASK>\n\nIn this case calling skb_orphan_frags() updated nr_frags leaving nrfrags\nlocal variable in skb_segment() stale. This resulted in the code hitting\ni >= nrfrags prematurely and trying to move to next frag_skb using\nlist_skb pointer, which was NULL, and caused kernel panic. Move the call\nto zero copy functions before using frags and nr_frags.","publishedAt":"2025-09-17T14:56:44.388Z","updatedAt":"2026-08-05T09:13:37.623Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"fcab3f661dbfd88e27ddbbe65368f3fa2d823175","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"d44403ec0676317b7f7edf2a035bb219fee3304e","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"8836c266201c29a5acb4f582227686f47b65ad61","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"d5790386595d06ea9decfd9ba5f1ea48cf09aa02","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"04c3eee4e13f60bf6f9a366ad39f88a01a57166e","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"6c26ed3c6abe86ddab0510529000b970b05c9b40","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"2ea35288c83b3d501a88bc17f2df8f176b5cc96f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.16","versionType":"semver"},{"version":"4.19.295","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.257","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.195","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.132","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.53","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.16","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5.3","status":"unaffected","lessThanOrEqual":"6.5.*","versionType":"semver"},{"version":"6.6","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]}],"references":["https://git.kernel.org/stable/c/fcab3f661dbfd88e27ddbbe65368f3fa2d823175","https://git.kernel.org/stable/c/d44403ec0676317b7f7edf2a035bb219fee3304e","https://git.kernel.org/stable/c/8836c266201c29a5acb4f582227686f47b65ad61","https://git.kernel.org/stable/c/d5790386595d06ea9decfd9ba5f1ea48cf09aa02","https://git.kernel.org/stable/c/04c3eee4e13f60bf6f9a366ad39f88a01a57166e","https://git.kernel.org/stable/c/f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb","https://git.kernel.org/stable/c/6c26ed3c6abe86ddab0510529000b970b05c9b40","https://git.kernel.org/stable/c/2ea35288c83b3d501a88bc17f2df8f176b5cc96f"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53354.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53354","state":"PUBLISHED","datePublished":"2025-09-17T14:56:44.388Z","dateUpdated":"2026-08-05T09:13:37.623Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-16T16:08:59.567Z"},"containers":{"cna":{"title":"skbuff: skb_segment, Call zero copy functions before using skbuff frags","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nskbuff: skb_segment, Call zero copy functions before using skbuff frags\n\nCommit bf5c25d60861 (\"skbuff: in skb_segment, call zerocopy functions\nonce per nskb\") added the call to zero copy functions in skb_segment().\nThe change introduced a bug in skb_segment() because skb_orphan_frags()\nmay possibly change the number of fragments or allocate new fragments\naltogether leaving nrfrags and frag to point to the old values. This can\ncause a panic with stacktrace like the one below.\n\n[  193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc\n[  193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G           O      5.15.123+ #26\n[  193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0\n[  194.021892] Call Trace:\n[  194.027422]  <TASK>\n[  194.072861]  tcp_gso_segment+0x107/0x540\n[  194.082031]  inet_gso_segment+0x15c/0x3d0\n[  194.090783]  skb_mac_gso_segment+0x9f/0x110\n[  194.095016]  __skb_gso_segment+0xc1/0x190\n[  194.103131]  netem_enqueue+0x290/0xb10 [sch_netem]\n[  194.107071]  dev_qdisc_enqueue+0x16/0x70\n[  194.110884]  __dev_queue_xmit+0x63b/0xb30\n[  194.121670]  bond_start_xmit+0x159/0x380 [bonding]\n[  194.128506]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.131787]  __dev_queue_xmit+0x8a0/0xb30\n[  194.138225]  macvlan_start_xmit+0x4f/0x100 [macvlan]\n[  194.141477]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.144622]  sch_direct_xmit+0xe3/0x280\n[  194.147748]  __dev_queue_xmit+0x54a/0xb30\n[  194.154131]  tap_get_user+0x2a8/0x9c0 [tap]\n[  194.157358]  tap_sendmsg+0x52/0x8e0 [tap]\n[  194.167049]  handle_tx_zerocopy+0x14e/0x4c0 [vhost_net]\n[  194.173631]  handle_tx+0xcd/0xe0 [vhost_net]\n[  194.176959]  vhost_worker+0x76/0xb0 [vhost]\n[  194.183667]  kthread+0x118/0x140\n[  194.190358]  ret_from_fork+0x1f/0x30\n[  194.193670]  </TASK>\n\nIn this case calling skb_orphan_frags() updated nr_frags leaving nrfrags\nlocal variable in skb_segment() stale. This resulted in the code hitting\ni >= nrfrags prematurely and trying to move to next frag_skb using\nlist_skb pointer, which was NULL, and caused kernel panic. Move the call\nto zero copy functions before using frags and nr_frags."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"fcab3f661dbfd88e27ddbbe65368f3fa2d823175","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"d44403ec0676317b7f7edf2a035bb219fee3304e","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"8836c266201c29a5acb4f582227686f47b65ad61","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"d5790386595d06ea9decfd9ba5f1ea48cf09aa02","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"04c3eee4e13f60bf6f9a366ad39f88a01a57166e","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"6c26ed3c6abe86ddab0510529000b970b05c9b40","versionType":"git"},{"version":"bf5c25d608613eaf4dcdba5a9cac5b2afe67d635","status":"affected","lessThan":"2ea35288c83b3d501a88bc17f2df8f176b5cc96f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.16","versionType":"semver"},{"version":"4.19.295","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.257","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.195","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.132","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.53","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.16","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5.3","status":"unaffected","lessThanOrEqual":"6.5.*","versionType":"semver"},{"version":"6.6","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/skbuff.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fcab3f661dbfd88e27ddbbe65368f3fa2d823175"},{"url":"https://git.kernel.org/stable/c/d44403ec0676317b7f7edf2a035bb219fee3304e"},{"url":"https://git.kernel.org/stable/c/8836c266201c29a5acb4f582227686f47b65ad61"},{"url":"https://git.kernel.org/stable/c/d5790386595d06ea9decfd9ba5f1ea48cf09aa02"},{"url":"https://git.kernel.org/stable/c/04c3eee4e13f60bf6f9a366ad39f88a01a57166e"},{"url":"https://git.kernel.org/stable/c/f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb"},{"url":"https://git.kernel.org/stable/c/6c26ed3c6abe86ddab0510529000b970b05c9b40"},{"url":"https://git.kernel.org/stable/c/2ea35288c83b3d501a88bc17f2df8f176b5cc96f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is only reachable on TX skbs with zerocopy user frags (MSG_ZEROCOPY or vhost_net handle_tx_zerocopy); received remote packets do not carry skb_zcopy state, so skb_orphan_frags() is a no-op and cannot trigger the stale-frag path.\nAC:L - An attacker controls SO_ZEROCOPY/MSG_ZEROCOPY iov layout (hence how skb_copy_ubufs() changes nr_frags) and can force software GSO via netem/tbf in an unprivileged user+net namespace or any non-TSO egress path, making the trigger reliable.\nPR:L - SO_ZEROCOPY has no capability check, and CAP_NET_ADMIN needed to attach netem or disable TSO is available via unprivileged user namespaces; no real init-namespace root is required.\nUI:N - The attacker triggers the bug entirely through their own socket sends and optional qdisc configuration; no victim interaction is required.\nS:U - Corruption and crash occur in host kernel skbuff/GSO state within the same kernel security authority; this is standard local kernel memory corruption, not a VM/IOMMU/sandbox boundary escape.\nC:H - When skb_copy_ubufs() reduces nr_frags, skb_segment continues with a stale larger nfrags and re-refs frag slots whose pages were already unreferenced, yielding a UAF that can disclose kernel memory.\nI:H - The same stale-frag UAF (and dangling frag pointer if skb_unclone relocates shinfo) is heap memory corruption exploitable for arbitrary write/control-flow hijacking per UAF scoring guidance.\nA:H - The reported impact is a kernel NULL pointer dereference panic in skb_segment, and the UAF paths also cause oops/panic-level denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:13:37.623Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"4.19.295"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.4.257"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.10.195"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.15.132"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.1.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.4.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.5.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.6"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-53354","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-01-14T18:42:19.915192Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","lang":"en","type":"CWE","description":"CWE-476 NULL Pointer Dereference"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T18:43:04.063Z"}}]}}}