{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce3ec57faff559ccae1e0150c1f077eb2df648a4",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            },
            {
              "lessThan": "03d63255a5783243c110aec5e6ae2f1475c3be76",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            },
            {
              "lessThan": "5f81018753dfd4989e33ece1f0cb6b8aae498b82",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Release rethook after the ftrace_ops is unregistered\n\nWhile running bpf selftests it\u0027s possible to get following fault:\n\n  general protection fault, probably for non-canonical address \\\n  0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   fprobe_handler+0xc1/0x270\n   ? __pfx_bpf_testmod_init+0x10/0x10\n   ? __pfx_bpf_testmod_init+0x10/0x10\n   ? bpf_fentry_test1+0x5/0x10\n   ? bpf_fentry_test1+0x5/0x10\n   ? bpf_testmod_init+0x22/0x80\n   ? do_one_initcall+0x63/0x2e0\n   ? rcu_is_watching+0xd/0x40\n   ? kmalloc_trace+0xaf/0xc0\n   ? do_init_module+0x60/0x250\n   ? __do_sys_finit_module+0xac/0x120\n   ? do_syscall_64+0x37/0x90\n   ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n   \u003c/TASK\u003e\n\nIn unregister_fprobe function we can\u0027t release fp-\u003erethook while it\u0027s\npossible there are some of its users still running on another cpu.\n\nMoving rethook_free call after fp-\u003eops is unregistered with\nunregister_ftrace_function call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local `bpf()` syscall \u2014 attaching a `kprobe_multi` return link and then closing its fd (`bpf_kprobe_multi_link_release()` \u2192 `unregister_fprobe()`). There is no network-facing path into fprobe/rethook.\nAC:L - The attacker controls both sides of the race: they pick which functions are traced (choosing hot paths, or calling them in tight loops on other CPUs), choose when to close the link fd, and can widen the window arbitrarily by contending `ftrace_lock`, which `unregister_ftrace_function()` blocks on before the ops is ever removed, so an RCU grace period reliably elapses while the handler is still live.\nPR:L - Attaching a `kprobe_multi` return probe needs CAP_BPF+CAP_PERFMON, which are delegatable non-root capabilities routinely granted to unprivileged observability/tracing daemons and containers (Cilium, Falco, profilers) rather than full administrative control of the system. Compromise of any such non-root component yields the primitive.\nUI:N - The attacker performs the entire sequence \u2014 attach the fprobe, close the link, keep the traced functions hot \u2014 with no action from any other user or victim process.\nS:U - The use-after-free corrupts kernel heap and kernel control flow within the same security authority; there is no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - The freed `struct rethook` is dereferenced after reallocation, giving an arbitrary read via `READ_ONCE(head-\u003enext)` in `freelist_try_get()`, and `arch_rethook_prepare()` plus `fpr-\u003eentry_ip` writes leak live kernel text/return addresses into attacker-observable memory, defeating KASLR and enabling broad memory disclosure.\nI:H - The UAF yields an atomic RMW write at an attacker-chosen address (`atomic_try_cmpxchg_acquire(\u0026head-\u003erefs, ...)`), controlled pointer writes via `fpr-\u003eentry_ip`/`entry_parent_ip`, and ultimately an indirect call through the attacker-controlled `rhn-\u003erethook-\u003ehandler` in `rethook_trampoline_handler()` \u2014 a direct kernel control-flow hijack and privilege escalation.\nA:H - Even unweaponized, the bug produces an immediate general protection fault on a non-canonical poisoned pointer inside `fprobe_handler()`, as shown in the commit\u0027s oops, panicking the kernel; it can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:48.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce3ec57faff559ccae1e0150c1f077eb2df648a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d63255a5783243c110aec5e6ae2f1475c3be76"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f81018753dfd4989e33ece1f0cb6b8aae498b82"
        }
      ],
      "title": "fprobe: Release rethook after the ftrace_ops is unregistered",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53557",
    "datePublished": "2025-10-04T15:17:02.077Z",
    "dateReserved": "2025-10-04T15:14:15.923Z",
    "dateUpdated": "2026-08-05T09:14:48.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}