{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a7690f2bd178eee80f33411ae32e543ae66379c",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "73f53bc295727a3cdbd9d6bcdfaa239258970cf4",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "037768b28e3752c07d63d1c72a651a6775b080bb",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "5306623a9826aa7d63b32c6a3803c798a765474d",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix error unwinding of XDP initialization\n\nWhen initializing XDP in virtnet_open(), some rq xdp initialization\nmay hit an error causing net device open failed. However, previous\nrqs have already initialized XDP and enabled NAPI, which is not the\nexpected behavior. Need to roll back the previous rq initialization\nto avoid leaks in error unwinding of init code.\n\nAlso extract helper functions of disable and enable queue pairs.\nUse newly introduced disable helper function in error unwinding and\nvirtnet_close. Use enable helper function in virtnet_open."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is `virtnet_open()`, reached only through the local administrative interface-up path (`dev_change_flags` via RTM_NEWLINK/SIOCSIFFLAGS) or the PM resume path `virtnet_restore_up()`. No remote peer data or received packet can reach it, so this requires local system access.\nAC:H - The faulty unwind path executes only if `xdp_rxq_info_reg()` or `xdp_rxq_info_reg_mem_model()` returns an error, and in every affected version (4.16\u20136.4) the latter short-circuits to 0 for `MEM_TYPE_PAGE_SHARED` with a NULL allocator while the former only fails on `!dev` or `REG_STATE_UNUSED`, neither of which virtio_net can produce. These are internal driver-invariant conditions with no attacker-controlled input or allocation involved, i.e. entirely beyond the attacker\u0027s influence.\nPR:L - Bringing the interface up requires CAP_NET_ADMIN in the network namespace owning the virtio-net device, not global root, and that capability can be held by a container/VM-guest administrator who is unprivileged with respect to the host. Treating this as Low rather than High is the higher-severity and defensible reading.\nUI:N - The attacker performs the interface-up (or triggers a suspend/resume) themselves; no action by any other user is needed to reach or complete the faulty error path.\nS:U - The leaked NAPI/xdp_rxq state and the orphaned refill work are all within the guest kernel\u0027s own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The un-cancelled `vi-\u003erefill` delayed work and still-registered `xdp_rxq_info` reference `virtnet_info`/`receive_queue` memory that `free_netdev()` releases on unbind or module unload, giving a use-after-free on freed slab data. Per kernel scoring guidance a UAF is treated as High confidentiality impact because the reclaimed object contents can be groomed and read back.\nI:H - The same stale refill work writes into the freed receive-queue/page-frag structures (`try_fill_recv`, `virtnet_napi_enable`), which is a write into reclaimed memory the attacker can heap-spray. A use-after-free write primitive of this form is scored as High integrity impact.\nA:H - A subsequent `virtnet_open()` on the leaked state hits `BUG_ON(!test_bit(NAPI_STATE_SCHED, ...))` in `napi_enable()` and `WARN(1, \"Missing unregister, handled but fix driver\")` in `xdp_rxq_info_reg()`, either of which panics the kernel (the WARN under panic_on_warn), and the orphaned refill work independently causes a UAF oops. Any such crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:28.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379c"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474d"
        }
      ],
      "title": "virtio_net: Fix error unwinding of XDP initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53499",
    "datePublished": "2025-10-01T11:45:50.367Z",
    "dateReserved": "2025-10-01T11:39:39.404Z",
    "dateUpdated": "2026-08-05T09:14:28.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}