GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53499 (GCVE-0-2023-53499)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2026-08-05 09:14
VLAI
Title
virtio_net: Fix error unwinding of XDP initialization
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 754b8a21a96d5f11712245aef907149606b323ae , < 6a7690f2bd178eee80f33411ae32e543ae66379c (git)
Affected: 754b8a21a96d5f11712245aef907149606b323ae , < 73f53bc295727a3cdbd9d6bcdfaa239258970cf4 (git)
Affected: 754b8a21a96d5f11712245aef907149606b323ae , < 037768b28e3752c07d63d1c72a651a6775b080bb (git)
Affected: 754b8a21a96d5f11712245aef907149606b323ae , < 5306623a9826aa7d63b32c6a3803c798a765474d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a7690f2bd178eee80f33411ae32e543ae66379c",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "73f53bc295727a3cdbd9d6bcdfaa239258970cf4",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "037768b28e3752c07d63d1c72a651a6775b080bb",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "5306623a9826aa7d63b32c6a3803c798a765474d",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix error unwinding of XDP initialization\n\nWhen initializing XDP in virtnet_open(), some rq xdp initialization\nmay hit an error causing net device open failed. However, previous\nrqs have already initialized XDP and enabled NAPI, which is not the\nexpected behavior. Need to roll back the previous rq initialization\nto avoid leaks in error unwinding of init code.\n\nAlso extract helper functions of disable and enable queue pairs.\nUse newly introduced disable helper function in error unwinding and\nvirtnet_close. Use enable helper function in virtnet_open."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is `virtnet_open()`, reached only through the local administrative interface-up path (`dev_change_flags` via RTM_NEWLINK/SIOCSIFFLAGS) or the PM resume path `virtnet_restore_up()`. No remote peer data or received packet can reach it, so this requires local system access.\nAC:H - The faulty unwind path executes only if `xdp_rxq_info_reg()` or `xdp_rxq_info_reg_mem_model()` returns an error, and in every affected version (4.16\u20136.4) the latter short-circuits to 0 for `MEM_TYPE_PAGE_SHARED` with a NULL allocator while the former only fails on `!dev` or `REG_STATE_UNUSED`, neither of which virtio_net can produce. These are internal driver-invariant conditions with no attacker-controlled input or allocation involved, i.e. entirely beyond the attacker\u0027s influence.\nPR:L - Bringing the interface up requires CAP_NET_ADMIN in the network namespace owning the virtio-net device, not global root, and that capability can be held by a container/VM-guest administrator who is unprivileged with respect to the host. Treating this as Low rather than High is the higher-severity and defensible reading.\nUI:N - The attacker performs the interface-up (or triggers a suspend/resume) themselves; no action by any other user is needed to reach or complete the faulty error path.\nS:U - The leaked NAPI/xdp_rxq state and the orphaned refill work are all within the guest kernel\u0027s own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The un-cancelled `vi-\u003erefill` delayed work and still-registered `xdp_rxq_info` reference `virtnet_info`/`receive_queue` memory that `free_netdev()` releases on unbind or module unload, giving a use-after-free on freed slab data. Per kernel scoring guidance a UAF is treated as High confidentiality impact because the reclaimed object contents can be groomed and read back.\nI:H - The same stale refill work writes into the freed receive-queue/page-frag structures (`try_fill_recv`, `virtnet_napi_enable`), which is a write into reclaimed memory the attacker can heap-spray. A use-after-free write primitive of this form is scored as High integrity impact.\nA:H - A subsequent `virtnet_open()` on the leaked state hits `BUG_ON(!test_bit(NAPI_STATE_SCHED, ...))` in `napi_enable()` and `WARN(1, \"Missing unregister, handled but fix driver\")` in `xdp_rxq_info_reg()`, either of which panics the kernel (the WARN under panic_on_warn), and the orphaned refill work independently causes a UAF oops. Any such crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:28.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379c"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474d"
        }
      ],
      "title": "virtio_net: Fix error unwinding of XDP initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53499",
    "datePublished": "2025-10-01T11:45:50.367Z",
    "dateReserved": "2025-10-01T11:39:39.404Z",
    "dateUpdated": "2026-08-05T09:14:28.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53499",
      "date": "2026-09-18",
      "epss": "0.00156",
      "percentile": "0.05214"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6a7690f2bd178eee80f33411ae32e543ae66379c",
                    "status": "affected",
                    "version": "754b8a21a96d5f11712245aef907149606b323ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "73f53bc295727a3cdbd9d6bcdfaa239258970cf4",
                    "status": "affected",
                    "version": "754b8a21a96d5f11712245aef907149606b323ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "037768b28e3752c07d63d1c72a651a6775b080bb",
                    "status": "affected",
                    "version": "754b8a21a96d5f11712245aef907149606b323ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5306623a9826aa7d63b32c6a3803c798a765474d",
                    "status": "affected",
                    "version": "754b8a21a96d5f11712245aef907149606b323ae",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "66FFC7F8-B806-41FD-8D5E-A020B21A9123",
                    "versionEndExcluding": "5.15.113",
                    "versionStartIncluding": "4.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9430E62-03EA-42E6-9E5E-BD1D5124D107",
                    "versionEndExcluding": "6.1.30",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26C54BF0-3EED-46D4-92A7-5F07F658B49B",
                    "versionEndExcluding": "6.3.4",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "38BC6744-7D25-4C02-9966-B224CD071D30",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "76061B41-CAE9-4467-BEDE-0FFC7956F2A1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix error unwinding of XDP initialization\n\nWhen initializing XDP in virtnet_open(), some rq xdp initialization\nmay hit an error causing net device open failed. However, previous\nrqs have already initialized XDP and enabled NAPI, which is not the\nexpected behavior. Need to roll back the previous rq initialization\nto avoid leaks in error unwinding of init code.\n\nAlso extract helper functions of disable and enable queue pairs.\nUse newly introduced disable helper function in error unwinding and\nvirtnet_close. Use enable helper function in virtnet_open."
          }
        ],
        "id": "CVE-2023-53499",
        "lastModified": "2026-08-04T10:19:09.523",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-01T12:15:53.350",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:19:54+00:00",
      "cve": "CVE-2023-53499",
      "id": "CVE-2023-53499",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "170",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio_net: Fix error unwinding of XDP initialization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53499.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:58:13Z",
      "cve": "CVE-2023-53499",
      "id": "CVE-2023-53499",
      "initial_release_date": "2025-10-01T23:30:07Z",
      "product_status:known_affected": "446",
      "product_status:known_not_affected": "235",
      "product_status:recommended": "258",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53499",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53499.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.