GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53669 (GCVE-0-2023-53669)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:21 – Updated: 2026-08-05 09:15
VLAI
Title
tcp: fix skb_copy_ubufs() vs BIG TCP
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c4e983c4f3cf94fcd879730c6caa877e0768a4d , < 7fa93e39fbb0566019c388a8038a4d58552e0910 (git)
Affected: 7c4e983c4f3cf94fcd879730c6caa877e0768a4d , < 3c77a377877acbaf03cd7caa21d3644a5dd16301 (git)
Affected: 7c4e983c4f3cf94fcd879730c6caa877e0768a4d , < 9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f (git)
Affected: 7c4e983c4f3cf94fcd879730c6caa877e0768a4d , < 7e692df3933628d974acb9f5b334d2b3e885e2a6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.29 , ≤ 6.1.* (semver)
Unaffected: 6.2.16 , ≤ 6.2.* (semver)
Unaffected: 6.3.3 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7fa93e39fbb0566019c388a8038a4d58552e0910",
              "status": "affected",
              "version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
              "versionType": "git"
            },
            {
              "lessThan": "3c77a377877acbaf03cd7caa21d3644a5dd16301",
              "status": "affected",
              "version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
              "versionType": "git"
            },
            {
              "lessThan": "9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f",
              "status": "affected",
              "version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
              "versionType": "git"
            },
            {
              "lessThan": "7e692df3933628d974acb9f5b334d2b3e885e2a6",
              "status": "affected",
              "version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.29",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix skb_copy_ubufs() vs BIG TCP\n\nDavid Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy\nusing hugepages, and skb length bigger than ~68 KB.\n\nskb_copy_ubufs() assumed it could copy all payload using up to\nMAX_SKB_FRAGS order-0 pages.\n\nThis assumption broke when BIG TCP was able to put up to 512 KB per skb.\n\nWe did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45\nand limit gso_max_size to 180000.\n\nA solution is to use higher order pages if needed.\n\nv2: add missing __GFP_COMP, or we leak memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code only runs on locally-originated TX skbs carrying MSG_ZEROCOPY frags; received network packets never carry zcopy frags (skb_zcopy() is false, early return), so a remote peer cannot reach it. Triggering requires local socket/syscall activity.\nAC:L - The local attacker controls every precondition \u2014 enabling BIG TCP (CAP_NET_ADMIN via user namespace on a private netns device), using THP/hugepage-backed buffers, and sending MSG_ZEROCOPY payloads sized to overflow \u2014 so the overflow is reliably reproducible.\nPR:L - Exploitation requires running local code (MSG_ZEROCOPY sendmsg) and CAP_NET_ADMIN to raise gso_max_size, both available to a basic unprivileged user through an unprivileged user+network namespace. No real root is needed.\nUI:N - The attacker triggers the overflow entirely through its own socket operations; no action by another user is required.\nS:U - The out-of-bounds write corrupts kernel heap within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The OOB write corrupts skb_shared_info frag page descriptors, which can be steered so kernel data is read/transmitted from attacker-influenced pages, and per guidance memory corruption leveragable for disclosure scores High.\nI:H - This is a controllable-size out-of-bounds heap write (frag descriptors written past the frags array), providing a write primitive suitable for control-flow hijacking or privilege escalation.\nA:H - The overflow reliably corrupts adjacent memory and was reported as causing kernel crashes (oops/panic), a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:25.435Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7fa93e39fbb0566019c388a8038a4d58552e0910"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c77a377877acbaf03cd7caa21d3644a5dd16301"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e692df3933628d974acb9f5b334d2b3e885e2a6"
        }
      ],
      "title": "tcp: fix skb_copy_ubufs() vs BIG TCP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53669",
    "datePublished": "2025-10-07T15:21:26.896Z",
    "dateReserved": "2025-10-07T15:16:59.663Z",
    "dateUpdated": "2026-08-05T09:15:25.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53669",
      "date": "2026-09-17",
      "epss": "0.00153",
      "percentile": "0.04786"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53669\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:50.770\",\"lastModified\":\"2026-08-04T10:19:16.920\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: fix skb_copy_ubufs() vs BIG TCP\\n\\nDavid Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy\\nusing hugepages, and skb length bigger than ~68 KB.\\n\\nskb_copy_ubufs() assumed it could copy all payload using up to\\nMAX_SKB_FRAGS order-0 pages.\\n\\nThis assumption broke when BIG TCP was able to put up to 512 KB per skb.\\n\\nWe did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45\\nand limit gso_max_size to 180000.\\n\\nA solution is to use higher order pages if needed.\\n\\nv2: add missing __GFP_COMP, or we leak memory.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/skbuff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c4e983c4f3cf94fcd879730c6caa877e0768a4d\",\"lessThan\":\"7fa93e39fbb0566019c388a8038a4d58552e0910\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c4e983c4f3cf94fcd879730c6caa877e0768a4d\",\"lessThan\":\"3c77a377877acbaf03cd7caa21d3644a5dd16301\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c4e983c4f3cf94fcd879730c6caa877e0768a4d\",\"lessThan\":\"9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c4e983c4f3cf94fcd879730c6caa877e0768a4d\",\"lessThan\":\"7e692df3933628d974acb9f5b334d2b3e885e2a6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/skbuff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.29\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.16\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.3\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.29\",\"matchCriteriaId\":\"573E342E-2B55-4488-86DF-4C7FD5453C75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.16\",\"matchCriteriaId\":\"F92F7C8E-A977-4255-B1B6-D1908D8B408F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.3.3\",\"matchCriteriaId\":\"6D96A7FC-D812-4458-AEA8-3FF4023E6B75\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c77a377877acbaf03cd7caa21d3644a5dd16301\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e692df3933628d974acb9f5b334d2b3e885e2a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7fa93e39fbb0566019c388a8038a4d58552e0910\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:10+00:00",
      "cve": "CVE-2023-53669",
      "id": "CVE-2023-53669",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: fix skb_copy_ubufs() vs BIG TCP",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53669.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:56:34Z",
      "cve": "CVE-2023-53669",
      "id": "CVE-2023-53669",
      "initial_release_date": "2025-10-08T23:30:16Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53669",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53669.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.