CVE-2023-53192 (GCVE-0-2023-53192)
Vulnerability from cvelistv5 – Published: 2025-09-15 14:06 – Updated: 2026-08-05 09:13
VLAI
EPSS
VEX
Title
vxlan: Fix nexthop hash size
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix nexthop hash size
The nexthop code expects a 31 bit hash, such as what is returned by
fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash
returned by skb_get_hash() can lead to problems related to the fact that
'int hash' is a negative number when the MSB is set.
In the case of hash threshold nexthop groups, nexthop_select_path_hthr()
will disproportionately select the first nexthop group entry. In the case
of resilient nexthop groups, nexthop_select_path_res() may do an out of
bounds access in nh_buckets[], for example:
hash = -912054133
num_nh_buckets = 2
bucket_index = 65535
which leads to the following panic:
BUG: unable to handle page fault for address: ffffc900025910c8
PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:nexthop_select_path+0x197/0xbf0
Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85
RSP: 0018:ffff88810c36f260 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8
RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219
R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0
R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0
PKRU: 55555554
Call Trace:
<TASK>
? __die+0x23/0x70
? page_fault_oops+0x1ee/0x5c0
? __pfx_is_prefetch.constprop.0+0x10/0x10
? __pfx_page_fault_oops+0x10/0x10
? search_bpf_extables+0xfe/0x1c0
? fixup_exception+0x3b/0x470
? exc_page_fault+0xf6/0x110
? asm_exc_page_fault+0x26/0x30
? nexthop_select_path+0x197/0xbf0
? nexthop_select_path+0x197/0xbf0
? lock_is_held_type+0xe7/0x140
vxlan_xmit+0x5b2/0x2340
? __lock_acquire+0x92b/0x3370
? __pfx_vxlan_xmit+0x10/0x10
? __pfx___lock_acquire+0x10/0x10
? __pfx_register_lock_class+0x10/0x10
? skb_network_protocol+0xce/0x2d0
? dev_hard_start_xmit+0xca/0x350
? __pfx_vxlan_xmit+0x10/0x10
dev_hard_start_xmit+0xca/0x350
__dev_queue_xmit+0x513/0x1e20
? __pfx___dev_queue_xmit+0x10/0x10
? __pfx_lock_release+0x10/0x10
? mark_held_locks+0x44/0x90
? skb_push+0x4c/0x80
? eth_header+0x81/0xe0
? __pfx_eth_header+0x10/0x10
? neigh_resolve_output+0x215/0x310
? ip6_finish_output2+0x2ba/0xc90
ip6_finish_output2+0x2ba/0xc90
? lock_release+0x236/0x3e0
? ip6_mtu+0xbb/0x240
? __pfx_ip6_finish_output2+0x10/0x10
? find_held_lock+0x83/0xa0
? lock_is_held_type+0xe7/0x140
ip6_finish_output+0x1ee/0x780
ip6_output+0x138/0x460
? __pfx_ip6_output+0x10/0x10
? __pfx___lock_acquire+0x10/0x10
? __pfx_ip6_finish_output+0x10/0x10
NF_HOOK.constprop.0+0xc0/0x420
? __pfx_NF_HOOK.constprop.0+0x10/0x10
? ndisc_send_skb+0x2c0/0x960
? __pfx_lock_release+0x10/0x10
? __local_bh_enable_ip+0x93/0x110
? lock_is_held_type+0xe7/0x140
ndisc_send_skb+0x4be/0x960
? __pfx_ndisc_send_skb+0x10/0x10
? mark_held_locks+0x65/0x90
? find_held_lock+0x83/0xa0
ndisc_send_ns+0xb0/0x110
? __pfx_ndisc_send_ns+0x10/0x10
addrconf_dad_work+0x631/0x8e0
? lock_acquire+0x180/0x3f0
? __pfx_addrconf_dad_work+0x10/0x10
? mark_held_locks+0x24/0x90
process_one_work+0x582/0x9c0
? __pfx_process_one_work+0x10/0x10
? __pfx_do_raw_spin_lock+0x10/0x10
? mark_held_locks+0x24/0x90
worker_thread+0x93/0x630
? __kthread_parkme+0xdc/0x100
? __pfx_worker_thread+0x10/0x10
kthread+0x1a5/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x34/0x60
---truncated---
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1274e1cc42264d4e629841e4f182795cb0becfd2 , < c650597647ecb318d02372277bdfd866c6829f78
(git)
Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 32ef2c0c6cf11a076f0280a7866b9abc47821e19 (git) Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 7b8717658dff8b471cbfc124bf9b5ca4229579ed (git) Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 23c195ce6f4aec86e1c9e1ea1c800381c4b465c7 (git) Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 0756384fb1bd38adb2ebcfd1307422f433a1d772 (git) |
guessed | |
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.190 , ≤ 5.10.* (semver) Unaffected: 5.15.126 , ≤ 5.15.* (semver) Unaffected: 6.1.45 , ≤ 6.1.* (semver) Unaffected: 6.4.10 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/vxlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c650597647ecb318d02372277bdfd866c6829f78",
"status": "affected",
"version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
"versionType": "git"
},
{
"lessThan": "32ef2c0c6cf11a076f0280a7866b9abc47821e19",
"status": "affected",
"version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
"versionType": "git"
},
{
"lessThan": "7b8717658dff8b471cbfc124bf9b5ca4229579ed",
"status": "affected",
"version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
"versionType": "git"
},
{
"lessThan": "23c195ce6f4aec86e1c9e1ea1c800381c4b465c7",
"status": "affected",
"version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
"versionType": "git"
},
{
"lessThan": "0756384fb1bd38adb2ebcfd1307422f433a1d772",
"status": "affected",
"version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/vxlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.190",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.126",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.45",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix nexthop hash size\n\nThe nexthop code expects a 31 bit hash, such as what is returned by\nfib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash\nreturned by skb_get_hash() can lead to problems related to the fact that\n\u0027int hash\u0027 is a negative number when the MSB is set.\n\nIn the case of hash threshold nexthop groups, nexthop_select_path_hthr()\nwill disproportionately select the first nexthop group entry. In the case\nof resilient nexthop groups, nexthop_select_path_res() may do an out of\nbounds access in nh_buckets[], for example:\n hash = -912054133\n num_nh_buckets = 2\n bucket_index = 65535\n\nwhich leads to the following panic:\n\nBUG: unable to handle page fault for address: ffffc900025910c8\nPGD 100000067 P4D 100000067 PUD 10026b067 PMD 0\nOops: 0002 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:nexthop_select_path+0x197/0xbf0\nCode: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff \u003c4d\u003e 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85\nRSP: 0018:ffff88810c36f260 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8\nRBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219\nR10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0\nR13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900\nFS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x1ee/0x5c0\n ? __pfx_is_prefetch.constprop.0+0x10/0x10\n ? __pfx_page_fault_oops+0x10/0x10\n ? search_bpf_extables+0xfe/0x1c0\n ? fixup_exception+0x3b/0x470\n ? exc_page_fault+0xf6/0x110\n ? asm_exc_page_fault+0x26/0x30\n ? nexthop_select_path+0x197/0xbf0\n ? nexthop_select_path+0x197/0xbf0\n ? lock_is_held_type+0xe7/0x140\n vxlan_xmit+0x5b2/0x2340\n ? __lock_acquire+0x92b/0x3370\n ? __pfx_vxlan_xmit+0x10/0x10\n ? __pfx___lock_acquire+0x10/0x10\n ? __pfx_register_lock_class+0x10/0x10\n ? skb_network_protocol+0xce/0x2d0\n ? dev_hard_start_xmit+0xca/0x350\n ? __pfx_vxlan_xmit+0x10/0x10\n dev_hard_start_xmit+0xca/0x350\n __dev_queue_xmit+0x513/0x1e20\n ? __pfx___dev_queue_xmit+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? mark_held_locks+0x44/0x90\n ? skb_push+0x4c/0x80\n ? eth_header+0x81/0xe0\n ? __pfx_eth_header+0x10/0x10\n ? neigh_resolve_output+0x215/0x310\n ? ip6_finish_output2+0x2ba/0xc90\n ip6_finish_output2+0x2ba/0xc90\n ? lock_release+0x236/0x3e0\n ? ip6_mtu+0xbb/0x240\n ? __pfx_ip6_finish_output2+0x10/0x10\n ? find_held_lock+0x83/0xa0\n ? lock_is_held_type+0xe7/0x140\n ip6_finish_output+0x1ee/0x780\n ip6_output+0x138/0x460\n ? __pfx_ip6_output+0x10/0x10\n ? __pfx___lock_acquire+0x10/0x10\n ? __pfx_ip6_finish_output+0x10/0x10\n NF_HOOK.constprop.0+0xc0/0x420\n ? __pfx_NF_HOOK.constprop.0+0x10/0x10\n ? ndisc_send_skb+0x2c0/0x960\n ? __pfx_lock_release+0x10/0x10\n ? __local_bh_enable_ip+0x93/0x110\n ? lock_is_held_type+0xe7/0x140\n ndisc_send_skb+0x4be/0x960\n ? __pfx_ndisc_send_skb+0x10/0x10\n ? mark_held_locks+0x65/0x90\n ? find_held_lock+0x83/0xa0\n ndisc_send_ns+0xb0/0x110\n ? __pfx_ndisc_send_ns+0x10/0x10\n addrconf_dad_work+0x631/0x8e0\n ? lock_acquire+0x180/0x3f0\n ? __pfx_addrconf_dad_work+0x10/0x10\n ? mark_held_locks+0x24/0x90\n process_one_work+0x582/0x9c0\n ? __pfx_process_one_work+0x10/0x10\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? mark_held_locks+0x24/0x90\n worker_thread+0x93/0x630\n ? __kthread_parkme+0xdc/0x100\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1a5/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x60\n \n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Once a VXLAN device has an FDB entry backed by a resilient nexthop group (EVPN multihoming), any traffic forwarded or transmitted through that path hits vxlan_xmit\u2192vxlan_xmit_nh; remote/tenant packets bridged into the overlay therefore reach the bug over the network.\nAC:L - About half of skb hashes have the MSB set, and with typical bucket counts a large fraction of those yield a negative modulo and OOB index, so an attacker can reliably trigger the corruption by sending ordinary traffic with no race or blind conditions.\nPR:N - Creating the VXLAN/nexthop configuration needs CAP_NET_ADMIN, but exploitation assumes that intended EVPN deployment and then requires no privileges or authentication\u2014unauthenticated packets on the overlay data path are sufficient.\nUI:N - No victim action is required; sending or forwarding frames that egress via the vulnerable VXLAN FDB nexthop path is enough.\nS:U - The corruption occurs in the host kernel networking authority that already processes the traffic; this is not a cross-boundary escape such as guest-to-hypervisor or IOMMU bypass.\nC:H - The resilient path indexes nh_buckets[] far out of range and then reads nh_entry from that OOB memory, which is unbounded memory disclosure potential under the scoring rule for OOB/memory corruption.\nI:H - nexthop_select_path_res performs an out-of-bounds write through nh_res_bucket_set_busy() before dereferencing the OOB nh_entry pointer, giving a memory-corruption / control-flow integrity impact.\nA:H - The commit documents a reproducible kernel oops and panic (write page fault in nexthop_select_path) when the OOB bucket index is used, so availability impact is complete host crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:13:03.244Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c650597647ecb318d02372277bdfd866c6829f78"
},
{
"url": "https://git.kernel.org/stable/c/32ef2c0c6cf11a076f0280a7866b9abc47821e19"
},
{
"url": "https://git.kernel.org/stable/c/7b8717658dff8b471cbfc124bf9b5ca4229579ed"
},
{
"url": "https://git.kernel.org/stable/c/23c195ce6f4aec86e1c9e1ea1c800381c4b465c7"
},
{
"url": "https://git.kernel.org/stable/c/0756384fb1bd38adb2ebcfd1307422f433a1d772"
}
],
"title": "vxlan: Fix nexthop hash size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53192",
"datePublished": "2025-09-15T14:06:37.241Z",
"dateReserved": "2025-09-15T13:59:19.066Z",
"dateUpdated": "2026-08-05T09:13:03.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-53192",
"date": "2026-09-16",
"epss": "0.0038",
"percentile": "0.31666"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53192\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:41.523\",\"lastModified\":\"2026-08-04T10:18:57.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvxlan: Fix nexthop hash size\\n\\nThe nexthop code expects a 31 bit hash, such as what is returned by\\nfib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash\\nreturned by skb_get_hash() can lead to problems related to the fact that\\n\u0027int hash\u0027 is a negative number when the MSB is set.\\n\\nIn the case of hash threshold nexthop groups, nexthop_select_path_hthr()\\nwill disproportionately select the first nexthop group entry. In the case\\nof resilient nexthop groups, nexthop_select_path_res() may do an out of\\nbounds access in nh_buckets[], for example:\\n hash = -912054133\\n num_nh_buckets = 2\\n bucket_index = 65535\\n\\nwhich leads to the following panic:\\n\\nBUG: unable to handle page fault for address: ffffc900025910c8\\nPGD 100000067 P4D 100000067 PUD 10026b067 PMD 0\\nOops: 0002 [#1] PREEMPT SMP KASAN NOPTI\\nCPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\nWorkqueue: ipv6_addrconf addrconf_dad_work\\nRIP: 0010:nexthop_select_path+0x197/0xbf0\\nCode: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff \u003c4d\u003e 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85\\nRSP: 0018:ffff88810c36f260 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77\\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8\\nRBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219\\nR10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0\\nR13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900\\nFS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n ? __die+0x23/0x70\\n ? page_fault_oops+0x1ee/0x5c0\\n ? __pfx_is_prefetch.constprop.0+0x10/0x10\\n ? __pfx_page_fault_oops+0x10/0x10\\n ? search_bpf_extables+0xfe/0x1c0\\n ? fixup_exception+0x3b/0x470\\n ? exc_page_fault+0xf6/0x110\\n ? asm_exc_page_fault+0x26/0x30\\n ? nexthop_select_path+0x197/0xbf0\\n ? nexthop_select_path+0x197/0xbf0\\n ? lock_is_held_type+0xe7/0x140\\n vxlan_xmit+0x5b2/0x2340\\n ? __lock_acquire+0x92b/0x3370\\n ? __pfx_vxlan_xmit+0x10/0x10\\n ? __pfx___lock_acquire+0x10/0x10\\n ? __pfx_register_lock_class+0x10/0x10\\n ? skb_network_protocol+0xce/0x2d0\\n ? dev_hard_start_xmit+0xca/0x350\\n ? __pfx_vxlan_xmit+0x10/0x10\\n dev_hard_start_xmit+0xca/0x350\\n __dev_queue_xmit+0x513/0x1e20\\n ? __pfx___dev_queue_xmit+0x10/0x10\\n ? __pfx_lock_release+0x10/0x10\\n ? mark_held_locks+0x44/0x90\\n ? skb_push+0x4c/0x80\\n ? eth_header+0x81/0xe0\\n ? __pfx_eth_header+0x10/0x10\\n ? neigh_resolve_output+0x215/0x310\\n ? ip6_finish_output2+0x2ba/0xc90\\n ip6_finish_output2+0x2ba/0xc90\\n ? lock_release+0x236/0x3e0\\n ? ip6_mtu+0xbb/0x240\\n ? __pfx_ip6_finish_output2+0x10/0x10\\n ? find_held_lock+0x83/0xa0\\n ? lock_is_held_type+0xe7/0x140\\n ip6_finish_output+0x1ee/0x780\\n ip6_output+0x138/0x460\\n ? __pfx_ip6_output+0x10/0x10\\n ? __pfx___lock_acquire+0x10/0x10\\n ? __pfx_ip6_finish_output+0x10/0x10\\n NF_HOOK.constprop.0+0xc0/0x420\\n ? __pfx_NF_HOOK.constprop.0+0x10/0x10\\n ? ndisc_send_skb+0x2c0/0x960\\n ? __pfx_lock_release+0x10/0x10\\n ? __local_bh_enable_ip+0x93/0x110\\n ? lock_is_held_type+0xe7/0x140\\n ndisc_send_skb+0x4be/0x960\\n ? __pfx_ndisc_send_skb+0x10/0x10\\n ? mark_held_locks+0x65/0x90\\n ? find_held_lock+0x83/0xa0\\n ndisc_send_ns+0xb0/0x110\\n ? __pfx_ndisc_send_ns+0x10/0x10\\n addrconf_dad_work+0x631/0x8e0\\n ? lock_acquire+0x180/0x3f0\\n ? __pfx_addrconf_dad_work+0x10/0x10\\n ? mark_held_locks+0x24/0x90\\n process_one_work+0x582/0x9c0\\n ? __pfx_process_one_work+0x10/0x10\\n ? __pfx_do_raw_spin_lock+0x10/0x10\\n ? mark_held_locks+0x24/0x90\\n worker_thread+0x93/0x630\\n ? __kthread_parkme+0xdc/0x100\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1a5/0x1e0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x34/0x60\\n \\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/vxlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"c650597647ecb318d02372277bdfd866c6829f78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"32ef2c0c6cf11a076f0280a7866b9abc47821e19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"7b8717658dff8b471cbfc124bf9b5ca4229579ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"23c195ce6f4aec86e1c9e1ea1c800381c4b465c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"0756384fb1bd38adb2ebcfd1307422f433a1d772\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/vxlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.190\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.126\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.45\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.10\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.190\",\"matchCriteriaId\":\"C473771A-D913-44FC-A8E1-725B5283D9D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.126\",\"matchCriteriaId\":\"C552AC9E-23B8-4D7D-AA26-57985BD93962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.45\",\"matchCriteriaId\":\"A0CA013D-55AF-4494-A931-AFC8EA64E875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.10\",\"matchCriteriaId\":\"7BB0D94C-4FCE-46F4-A8D4-062D6A84627A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6E4D-E24E-4630-B00C-8C9901C597B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0756384fb1bd38adb2ebcfd1307422f433a1d772\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23c195ce6f4aec86e1c9e1ea1c800381c4b465c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32ef2c0c6cf11a076f0280a7866b9abc47821e19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b8717658dff8b471cbfc124bf9b5ca4229579ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c650597647ecb318d02372277bdfd866c6829f78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:21:20+00:00",
"cve": "CVE-2023-53192",
"id": "CVE-2023-53192",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:fixed": "644",
"product_status:known_affected": "14",
"product_status:known_not_affected": "174",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial of service",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53192.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-04T00:31:26Z",
"cve": "CVE-2023-53192",
"id": "CVE-2023-53192",
"initial_release_date": "2025-09-17T23:29:35Z",
"product_status:known_affected": "498",
"product_status:known_not_affected": "289",
"product_status:recommended": "339",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2023-53192",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53192.json",
"version": "46"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…