GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53080 (GCVE-0-2023-53080)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
xsk: Add missing overflow check in xdp_umem_reg
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: Add missing overflow check in xdp_umem_reg The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bbff2f321a864ee07c9d3d1245af498023146951 , < 580634b03a55f04a3c1968bcbd97736c079c6601 (git)
Affected: bbff2f321a864ee07c9d3d1245af498023146951 , < 3cfc3564411acf96bf2fb791f706a1aa4f872c1d (git)
Affected: bbff2f321a864ee07c9d3d1245af498023146951 , < a069909acc4435eeb41d05ccc03baa447cc01b7e (git)
Affected: bbff2f321a864ee07c9d3d1245af498023146951 , < bb2e3bfb2a79db0c2057c6f701b782954394c67f (git)
Affected: bbff2f321a864ee07c9d3d1245af498023146951 , < c7df4813b149362248d6ef7be41a311e27bf75fe (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.177 , ≤ 5.10.* (semver)
Unaffected: 5.15.105 , ≤ 5.15.* (semver)
Unaffected: 6.1.22 , ≤ 6.1.* (semver)
Unaffected: 6.2.9 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "580634b03a55f04a3c1968bcbd97736c079c6601",
              "status": "affected",
              "version": "bbff2f321a864ee07c9d3d1245af498023146951",
              "versionType": "git"
            },
            {
              "lessThan": "3cfc3564411acf96bf2fb791f706a1aa4f872c1d",
              "status": "affected",
              "version": "bbff2f321a864ee07c9d3d1245af498023146951",
              "versionType": "git"
            },
            {
              "lessThan": "a069909acc4435eeb41d05ccc03baa447cc01b7e",
              "status": "affected",
              "version": "bbff2f321a864ee07c9d3d1245af498023146951",
              "versionType": "git"
            },
            {
              "lessThan": "bb2e3bfb2a79db0c2057c6f701b782954394c67f",
              "status": "affected",
              "version": "bbff2f321a864ee07c9d3d1245af498023146951",
              "versionType": "git"
            },
            {
              "lessThan": "c7df4813b149362248d6ef7be41a311e27bf75fe",
              "status": "affected",
              "version": "bbff2f321a864ee07c9d3d1245af498023146951",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.177",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.105",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Add missing overflow check in xdp_umem_reg\n\nThe number of chunks can overflow u32. Make sure to return -EINVAL on\noverflow. Also remove a redundant u32 cast assigning umem-\u003enpgs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via AF_XDP setsockopt(XDP_UMEM_REG) on a local socket (socket(AF_XDP) \u2192 xsk_setsockopt \u2192 xdp_umem_create \u2192 xdp_umem_reg), not via remote packet processing.\nAC:L - The attacker fully controls umem size and chunk_size; on a large-memory AF_XDP host with sufficient memlock the overflow and subsequent OOB via crafted fill-queue addresses are reliably reproducible with no race or victim-state dependency.\nPR:L - Socket creation only requires ns_capable(net-\u003euser_ns, CAP_NET_RAW), which an unprivileged user can obtain in a user+net namespace (unshare -Urn); no init-namespace root is required for the vulnerable registration path.\nUI:N - Exploitation is entirely via the attacker\u2019s own syscalls (socket/setsockopt/bind and ring operations); no victim action is required.\nS:U - Impact is memory corruption within the host kernel\u2019s AF_XDP/umem subsystem and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - Truncated umem-\u003echunks undersizes pool-\u003eheads while addrs_cnt remains the full umem size, so xp_alloc indexing via xp_aligned_extract_idx yields out-of-bounds reads of adjacent kernel heap objects.\nI:H - The same heads[] OOB write/use of attacker-influenced xdp_buff_xsk slots is memory corruption that can be leveraged for control-flow hijacking or arbitrary kernel writes.\nA:H - Out-of-bounds heads[] access can oops/panic the kernel, and any such memory-corruption path is scored Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:38.067Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/580634b03a55f04a3c1968bcbd97736c079c6601"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cfc3564411acf96bf2fb791f706a1aa4f872c1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a069909acc4435eeb41d05ccc03baa447cc01b7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb2e3bfb2a79db0c2057c6f701b782954394c67f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7df4813b149362248d6ef7be41a311e27bf75fe"
        }
      ],
      "title": "xsk: Add missing overflow check in xdp_umem_reg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53080",
    "datePublished": "2025-05-02T15:55:29.825Z",
    "dateReserved": "2025-05-02T15:51:43.549Z",
    "dateUpdated": "2026-08-05T09:12:38.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53080",
      "date": "2026-09-20",
      "epss": "0.0022",
      "percentile": "0.12843"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/xdp/xdp_umem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "580634b03a55f04a3c1968bcbd97736c079c6601",
                    "status": "affected",
                    "version": "bbff2f321a864ee07c9d3d1245af498023146951",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3cfc3564411acf96bf2fb791f706a1aa4f872c1d",
                    "status": "affected",
                    "version": "bbff2f321a864ee07c9d3d1245af498023146951",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a069909acc4435eeb41d05ccc03baa447cc01b7e",
                    "status": "affected",
                    "version": "bbff2f321a864ee07c9d3d1245af498023146951",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb2e3bfb2a79db0c2057c6f701b782954394c67f",
                    "status": "affected",
                    "version": "bbff2f321a864ee07c9d3d1245af498023146951",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7df4813b149362248d6ef7be41a311e27bf75fe",
                    "status": "affected",
                    "version": "bbff2f321a864ee07c9d3d1245af498023146951",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/xdp/xdp_umem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1B82E3C-782C-4AAE-93EF-F27BB43D50FE",
                    "versionEndExcluding": "5.10.177",
                    "versionStartIncluding": "4.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0888AE70-CB0A-45C0-B9BD-A5371244C8DB",
                    "versionEndExcluding": "5.15.105",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "642B6F99-95C6-47F5-A9B1-5C45FE08CAD0",
                    "versionEndExcluding": "6.1.22",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914F22DD-1E6F-4B0A-A14D-3A9F068F6761",
                    "versionEndExcluding": "6.2.9",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3583026A-27EC-4A4C-850A-83F2AF970673",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Add missing overflow check in xdp_umem_reg\n\nThe number of chunks can overflow u32. Make sure to return -EINVAL on\noverflow. Also remove a redundant u32 cast assigning umem-\u003enpgs."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xsk: Se ha a\u00f1adido una comprobaci\u00f3n de desbordamiento faltante en xdp_umem_reg. El n\u00famero de fragmentos puede desbordar u32. Aseg\u00farese de devolver -EINVAL en caso de desbordamiento. Tambi\u00e9n se ha eliminado una conversi\u00f3n u32 redundante que asigna umem-\u0026gt;npgs."
          }
        ],
        "id": "CVE-2023-53080",
        "lastModified": "2026-08-04T10:18:53.940",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-02T16:15:27.020",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3cfc3564411acf96bf2fb791f706a1aa4f872c1d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/580634b03a55f04a3c1968bcbd97736c079c6601"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a069909acc4435eeb41d05ccc03baa447cc01b7e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bb2e3bfb2a79db0c2057c6f701b782954394c67f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c7df4813b149362248d6ef7be41a311e27bf75fe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:21:51+00:00",
      "cve": "CVE-2023-53080",
      "id": "CVE-2023-53080",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xsk: Add missing overflow check in xdp_umem_reg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53080.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:01:28Z",
      "cve": "CVE-2023-53080",
      "id": "CVE-2023-53080",
      "initial_release_date": "2025-05-03T02:51:05Z",
      "product_status:known_affected": "558",
      "product_status:known_not_affected": "284",
      "product_status:recommended": "23",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53080",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53080.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.