GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53192 (GCVE-0-2023-53192)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:06 – Updated: 2026-08-05 09:13
VLAI
Title
vxlan: Fix nexthop hash size
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example: hash = -912054133 num_nh_buckets = 2 bucket_index = 65535 which leads to the following panic: BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ? ndisc_send_skb+0x2c0/0x960 ? __pfx_lock_release+0x10/0x10 ? __local_bh_enable_ip+0x93/0x110 ? lock_is_held_type+0xe7/0x140 ndisc_send_skb+0x4be/0x960 ? __pfx_ndisc_send_skb+0x10/0x10 ? mark_held_locks+0x65/0x90 ? find_held_lock+0x83/0xa0 ndisc_send_ns+0xb0/0x110 ? __pfx_ndisc_send_ns+0x10/0x10 addrconf_dad_work+0x631/0x8e0 ? lock_acquire+0x180/0x3f0 ? __pfx_addrconf_dad_work+0x10/0x10 ? mark_held_locks+0x24/0x90 process_one_work+0x582/0x9c0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x24/0x90 worker_thread+0x93/0x630 ? __kthread_parkme+0xdc/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1a5/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ---truncated---
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < c650597647ecb318d02372277bdfd866c6829f78 (git)
Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 32ef2c0c6cf11a076f0280a7866b9abc47821e19 (git)
Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 7b8717658dff8b471cbfc124bf9b5ca4229579ed (git)
Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 23c195ce6f4aec86e1c9e1ea1c800381c4b465c7 (git)
Affected: 1274e1cc42264d4e629841e4f182795cb0becfd2 , < 0756384fb1bd38adb2ebcfd1307422f433a1d772 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.190 , ≤ 5.10.* (semver)
Unaffected: 5.15.126 , ≤ 5.15.* (semver)
Unaffected: 6.1.45 , ≤ 6.1.* (semver)
Unaffected: 6.4.10 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/vxlan.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c650597647ecb318d02372277bdfd866c6829f78",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "32ef2c0c6cf11a076f0280a7866b9abc47821e19",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "7b8717658dff8b471cbfc124bf9b5ca4229579ed",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "23c195ce6f4aec86e1c9e1ea1c800381c4b465c7",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "0756384fb1bd38adb2ebcfd1307422f433a1d772",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/vxlan.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.190",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.126",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.45",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix nexthop hash size\n\nThe nexthop code expects a 31 bit hash, such as what is returned by\nfib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash\nreturned by skb_get_hash() can lead to problems related to the fact that\n\u0027int hash\u0027 is a negative number when the MSB is set.\n\nIn the case of hash threshold nexthop groups, nexthop_select_path_hthr()\nwill disproportionately select the first nexthop group entry. In the case\nof resilient nexthop groups, nexthop_select_path_res() may do an out of\nbounds access in nh_buckets[], for example:\n    hash = -912054133\n    num_nh_buckets = 2\n    bucket_index = 65535\n\nwhich leads to the following panic:\n\nBUG: unable to handle page fault for address: ffffc900025910c8\nPGD 100000067 P4D 100000067 PUD 10026b067 PMD 0\nOops: 0002 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:nexthop_select_path+0x197/0xbf0\nCode: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff \u003c4d\u003e 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85\nRSP: 0018:ffff88810c36f260 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8\nRBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219\nR10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0\nR13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900\nFS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x1ee/0x5c0\n ? __pfx_is_prefetch.constprop.0+0x10/0x10\n ? __pfx_page_fault_oops+0x10/0x10\n ? search_bpf_extables+0xfe/0x1c0\n ? fixup_exception+0x3b/0x470\n ? exc_page_fault+0xf6/0x110\n ? asm_exc_page_fault+0x26/0x30\n ? nexthop_select_path+0x197/0xbf0\n ? nexthop_select_path+0x197/0xbf0\n ? lock_is_held_type+0xe7/0x140\n vxlan_xmit+0x5b2/0x2340\n ? __lock_acquire+0x92b/0x3370\n ? __pfx_vxlan_xmit+0x10/0x10\n ? __pfx___lock_acquire+0x10/0x10\n ? __pfx_register_lock_class+0x10/0x10\n ? skb_network_protocol+0xce/0x2d0\n ? dev_hard_start_xmit+0xca/0x350\n ? __pfx_vxlan_xmit+0x10/0x10\n dev_hard_start_xmit+0xca/0x350\n __dev_queue_xmit+0x513/0x1e20\n ? __pfx___dev_queue_xmit+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? mark_held_locks+0x44/0x90\n ? skb_push+0x4c/0x80\n ? eth_header+0x81/0xe0\n ? __pfx_eth_header+0x10/0x10\n ? neigh_resolve_output+0x215/0x310\n ? ip6_finish_output2+0x2ba/0xc90\n ip6_finish_output2+0x2ba/0xc90\n ? lock_release+0x236/0x3e0\n ? ip6_mtu+0xbb/0x240\n ? __pfx_ip6_finish_output2+0x10/0x10\n ? find_held_lock+0x83/0xa0\n ? lock_is_held_type+0xe7/0x140\n ip6_finish_output+0x1ee/0x780\n ip6_output+0x138/0x460\n ? __pfx_ip6_output+0x10/0x10\n ? __pfx___lock_acquire+0x10/0x10\n ? __pfx_ip6_finish_output+0x10/0x10\n NF_HOOK.constprop.0+0xc0/0x420\n ? __pfx_NF_HOOK.constprop.0+0x10/0x10\n ? ndisc_send_skb+0x2c0/0x960\n ? __pfx_lock_release+0x10/0x10\n ? __local_bh_enable_ip+0x93/0x110\n ? lock_is_held_type+0xe7/0x140\n ndisc_send_skb+0x4be/0x960\n ? __pfx_ndisc_send_skb+0x10/0x10\n ? mark_held_locks+0x65/0x90\n ? find_held_lock+0x83/0xa0\n ndisc_send_ns+0xb0/0x110\n ? __pfx_ndisc_send_ns+0x10/0x10\n addrconf_dad_work+0x631/0x8e0\n ? lock_acquire+0x180/0x3f0\n ? __pfx_addrconf_dad_work+0x10/0x10\n ? mark_held_locks+0x24/0x90\n process_one_work+0x582/0x9c0\n ? __pfx_process_one_work+0x10/0x10\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? mark_held_locks+0x24/0x90\n worker_thread+0x93/0x630\n ? __kthread_parkme+0xdc/0x100\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1a5/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x60\n \n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Once a VXLAN device has an FDB entry backed by a resilient nexthop group (EVPN multihoming), any traffic forwarded or transmitted through that path hits vxlan_xmit\u2192vxlan_xmit_nh; remote/tenant packets bridged into the overlay therefore reach the bug over the network.\nAC:L - About half of skb hashes have the MSB set, and with typical bucket counts a large fraction of those yield a negative modulo and OOB index, so an attacker can reliably trigger the corruption by sending ordinary traffic with no race or blind conditions.\nPR:N - Creating the VXLAN/nexthop configuration needs CAP_NET_ADMIN, but exploitation assumes that intended EVPN deployment and then requires no privileges or authentication\u2014unauthenticated packets on the overlay data path are sufficient.\nUI:N - No victim action is required; sending or forwarding frames that egress via the vulnerable VXLAN FDB nexthop path is enough.\nS:U - The corruption occurs in the host kernel networking authority that already processes the traffic; this is not a cross-boundary escape such as guest-to-hypervisor or IOMMU bypass.\nC:H - The resilient path indexes nh_buckets[] far out of range and then reads nh_entry from that OOB memory, which is unbounded memory disclosure potential under the scoring rule for OOB/memory corruption.\nI:H - nexthop_select_path_res performs an out-of-bounds write through nh_res_bucket_set_busy() before dereferencing the OOB nh_entry pointer, giving a memory-corruption / control-flow integrity impact.\nA:H - The commit documents a reproducible kernel oops and panic (write page fault in nexthop_select_path) when the OOB bucket index is used, so availability impact is complete host crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:03.244Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c650597647ecb318d02372277bdfd866c6829f78"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ef2c0c6cf11a076f0280a7866b9abc47821e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b8717658dff8b471cbfc124bf9b5ca4229579ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/23c195ce6f4aec86e1c9e1ea1c800381c4b465c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0756384fb1bd38adb2ebcfd1307422f433a1d772"
        }
      ],
      "title": "vxlan: Fix nexthop hash size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53192",
    "datePublished": "2025-09-15T14:06:37.241Z",
    "dateReserved": "2025-09-15T13:59:19.066Z",
    "dateUpdated": "2026-08-05T09:13:03.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53192",
      "date": "2026-09-16",
      "epss": "0.0038",
      "percentile": "0.31666"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53192\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:41.523\",\"lastModified\":\"2026-08-04T10:18:57.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvxlan: Fix nexthop hash size\\n\\nThe nexthop code expects a 31 bit hash, such as what is returned by\\nfib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash\\nreturned by skb_get_hash() can lead to problems related to the fact that\\n\u0027int hash\u0027 is a negative number when the MSB is set.\\n\\nIn the case of hash threshold nexthop groups, nexthop_select_path_hthr()\\nwill disproportionately select the first nexthop group entry. In the case\\nof resilient nexthop groups, nexthop_select_path_res() may do an out of\\nbounds access in nh_buckets[], for example:\\n    hash = -912054133\\n    num_nh_buckets = 2\\n    bucket_index = 65535\\n\\nwhich leads to the following panic:\\n\\nBUG: unable to handle page fault for address: ffffc900025910c8\\nPGD 100000067 P4D 100000067 PUD 10026b067 PMD 0\\nOops: 0002 [#1] PREEMPT SMP KASAN NOPTI\\nCPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\nWorkqueue: ipv6_addrconf addrconf_dad_work\\nRIP: 0010:nexthop_select_path+0x197/0xbf0\\nCode: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff \u003c4d\u003e 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85\\nRSP: 0018:ffff88810c36f260 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77\\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8\\nRBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219\\nR10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0\\nR13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900\\nFS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n ? __die+0x23/0x70\\n ? page_fault_oops+0x1ee/0x5c0\\n ? __pfx_is_prefetch.constprop.0+0x10/0x10\\n ? __pfx_page_fault_oops+0x10/0x10\\n ? search_bpf_extables+0xfe/0x1c0\\n ? fixup_exception+0x3b/0x470\\n ? exc_page_fault+0xf6/0x110\\n ? asm_exc_page_fault+0x26/0x30\\n ? nexthop_select_path+0x197/0xbf0\\n ? nexthop_select_path+0x197/0xbf0\\n ? lock_is_held_type+0xe7/0x140\\n vxlan_xmit+0x5b2/0x2340\\n ? __lock_acquire+0x92b/0x3370\\n ? __pfx_vxlan_xmit+0x10/0x10\\n ? __pfx___lock_acquire+0x10/0x10\\n ? __pfx_register_lock_class+0x10/0x10\\n ? skb_network_protocol+0xce/0x2d0\\n ? dev_hard_start_xmit+0xca/0x350\\n ? __pfx_vxlan_xmit+0x10/0x10\\n dev_hard_start_xmit+0xca/0x350\\n __dev_queue_xmit+0x513/0x1e20\\n ? __pfx___dev_queue_xmit+0x10/0x10\\n ? __pfx_lock_release+0x10/0x10\\n ? mark_held_locks+0x44/0x90\\n ? skb_push+0x4c/0x80\\n ? eth_header+0x81/0xe0\\n ? __pfx_eth_header+0x10/0x10\\n ? neigh_resolve_output+0x215/0x310\\n ? ip6_finish_output2+0x2ba/0xc90\\n ip6_finish_output2+0x2ba/0xc90\\n ? lock_release+0x236/0x3e0\\n ? ip6_mtu+0xbb/0x240\\n ? __pfx_ip6_finish_output2+0x10/0x10\\n ? find_held_lock+0x83/0xa0\\n ? lock_is_held_type+0xe7/0x140\\n ip6_finish_output+0x1ee/0x780\\n ip6_output+0x138/0x460\\n ? __pfx_ip6_output+0x10/0x10\\n ? __pfx___lock_acquire+0x10/0x10\\n ? __pfx_ip6_finish_output+0x10/0x10\\n NF_HOOK.constprop.0+0xc0/0x420\\n ? __pfx_NF_HOOK.constprop.0+0x10/0x10\\n ? ndisc_send_skb+0x2c0/0x960\\n ? __pfx_lock_release+0x10/0x10\\n ? __local_bh_enable_ip+0x93/0x110\\n ? lock_is_held_type+0xe7/0x140\\n ndisc_send_skb+0x4be/0x960\\n ? __pfx_ndisc_send_skb+0x10/0x10\\n ? mark_held_locks+0x65/0x90\\n ? find_held_lock+0x83/0xa0\\n ndisc_send_ns+0xb0/0x110\\n ? __pfx_ndisc_send_ns+0x10/0x10\\n addrconf_dad_work+0x631/0x8e0\\n ? lock_acquire+0x180/0x3f0\\n ? __pfx_addrconf_dad_work+0x10/0x10\\n ? mark_held_locks+0x24/0x90\\n process_one_work+0x582/0x9c0\\n ? __pfx_process_one_work+0x10/0x10\\n ? __pfx_do_raw_spin_lock+0x10/0x10\\n ? mark_held_locks+0x24/0x90\\n worker_thread+0x93/0x630\\n ? __kthread_parkme+0xdc/0x100\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1a5/0x1e0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x34/0x60\\n \\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/vxlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"c650597647ecb318d02372277bdfd866c6829f78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"32ef2c0c6cf11a076f0280a7866b9abc47821e19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"7b8717658dff8b471cbfc124bf9b5ca4229579ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"23c195ce6f4aec86e1c9e1ea1c800381c4b465c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1274e1cc42264d4e629841e4f182795cb0becfd2\",\"lessThan\":\"0756384fb1bd38adb2ebcfd1307422f433a1d772\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/vxlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.190\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.126\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.45\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.10\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.190\",\"matchCriteriaId\":\"C473771A-D913-44FC-A8E1-725B5283D9D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.126\",\"matchCriteriaId\":\"C552AC9E-23B8-4D7D-AA26-57985BD93962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.45\",\"matchCriteriaId\":\"A0CA013D-55AF-4494-A931-AFC8EA64E875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.10\",\"matchCriteriaId\":\"7BB0D94C-4FCE-46F4-A8D4-062D6A84627A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6E4D-E24E-4630-B00C-8C9901C597B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0756384fb1bd38adb2ebcfd1307422f433a1d772\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23c195ce6f4aec86e1c9e1ea1c800381c4b465c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32ef2c0c6cf11a076f0280a7866b9abc47821e19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b8717658dff8b471cbfc124bf9b5ca4229579ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c650597647ecb318d02372277bdfd866c6829f78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:21:20+00:00",
      "cve": "CVE-2023-53192",
      "id": "CVE-2023-53192",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "644",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "174",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53192.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:31:26Z",
      "cve": "CVE-2023-53192",
      "id": "CVE-2023-53192",
      "initial_release_date": "2025-09-17T23:29:35Z",
      "product_status:known_affected": "498",
      "product_status:known_not_affected": "289",
      "product_status:recommended": "339",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53192",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53192.json",
      "version": "46"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…