GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53821 (GCVE-0-2023-53821)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-05-11 19:52
VLAI
Title
ip6_vti: fix slab-use-after-free in decode_session6
Summary
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 0f0ab8d52ee0062b28367dea23c29e254a26d7db (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < fa6c6c04f6c9b21b315023f487e5a07ae7fcf647 (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < eb47e612e59c358c3968a92f90dd36c78c9a2106 (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36 (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < a1639a82ce14af76b6419778d343ccbff86ee626 (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 55ad2309205cc00c585344374c7472420e1b2c12 (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < c070688bfbe7759e61e697e421b2a331b0dd74bc (git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 4.14.324 , ≤ 4.14.* (semver)
Unaffected: 4.19.293 , ≤ 4.19.* (semver)
Unaffected: 5.4.255 , ≤ 5.4.* (semver)
Unaffected: 5.10.192 , ≤ 5.10.* (semver)
Unaffected: 5.15.128 , ≤ 5.15.* (semver)
Unaffected: 6.1.47 , ≤ 6.1.* (semver)
Unaffected: 6.4.12 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f0ab8d52ee0062b28367dea23c29e254a26d7db",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "fa6c6c04f6c9b21b315023f487e5a07ae7fcf647",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "eb47e612e59c358c3968a92f90dd36c78c9a2106",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "a1639a82ce14af76b6419778d343ccbff86ee626",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "55ad2309205cc00c585344374c7472420e1b2c12",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "c070688bfbe7759e61e697e421b2a331b0dd74bc",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            },
            {
              "lessThan": "9fd41f1ba638938c9a1195d09bc6fa3be2712f25",
              "status": "affected",
              "version": "f855691975bb06373a98711e4cfe2c224244b536",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.324",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.255",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.324",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.293",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.255",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.192",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.128",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.47",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.12",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_vti: fix slab-use-after-free in decode_session6\n\nWhen ipv6_vti device is set to the qdisc of the sfb type, the cb field\nof the sent skb may be modified during enqueuing. Then,\nslab-use-after-free may occur when ipv6_vti device sends IPv6 packets.\n\nThe stack information is as follows:\nBUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890\nRead of size 1 at addr ffff88802e08edc2 by task swapper/0/0\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\nCall Trace:\n\u003cIRQ\u003e\ndump_stack_lvl+0xd9/0x150\nprint_address_description.constprop.0+0x2c/0x3c0\nkasan_report+0x11d/0x130\ndecode_session6+0x103f/0x1890\n__xfrm_decode_session+0x54/0xb0\nvti6_tnl_xmit+0x3e6/0x1ee0\ndev_hard_start_xmit+0x187/0x700\nsch_direct_xmit+0x1a3/0xc30\n__qdisc_run+0x510/0x17a0\n__dev_queue_xmit+0x2215/0x3b10\nneigh_connected_output+0x3c2/0x550\nip6_finish_output2+0x55a/0x1550\nip6_finish_output+0x6b9/0x1270\nip6_output+0x1f1/0x540\nndisc_send_skb+0xa63/0x1890\nndisc_send_rs+0x132/0x6f0\naddrconf_rs_timer+0x3f1/0x870\ncall_timer_fn+0x1a0/0x580\nexpire_timers+0x29b/0x4b0\nrun_timer_softirq+0x326/0x910\n__do_softirq+0x1d4/0x905\nirq_exit_rcu+0xb7/0x120\nsysvec_apic_timer_interrupt+0x97/0xc0\n\u003c/IRQ\u003e\nAllocated by task 9176:\nkasan_save_stack+0x22/0x40\nkasan_set_track+0x25/0x30\n__kasan_slab_alloc+0x7f/0x90\nkmem_cache_alloc_node+0x1cd/0x410\nkmalloc_reserve+0x165/0x270\n__alloc_skb+0x129/0x330\nnetlink_sendmsg+0x9b1/0xe30\nsock_sendmsg+0xde/0x190\n____sys_sendmsg+0x739/0x920\n___sys_sendmsg+0x110/0x1b0\n__sys_sendmsg+0xf7/0x1c0\ndo_syscall_64+0x39/0xb0\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nFreed by task 9176:\nkasan_save_stack+0x22/0x40\nkasan_set_track+0x25/0x30\nkasan_save_free_info+0x2b/0x40\n____kasan_slab_free+0x160/0x1c0\nslab_free_freelist_hook+0x11b/0x220\nkmem_cache_free+0xf0/0x490\nskb_free_head+0x17f/0x1b0\nskb_release_data+0x59c/0x850\nconsume_skb+0xd2/0x170\nnetlink_unicast+0x54f/0x7f0\nnetlink_sendmsg+0x926/0xe30\nsock_sendmsg+0xde/0x190\n____sys_sendmsg+0x739/0x920\n___sys_sendmsg+0x110/0x1b0\n__sys_sendmsg+0xf7/0x1c0\ndo_syscall_64+0x39/0xb0\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nThe buggy address belongs to the object at ffff88802e08ed00\nwhich belongs to the cache skbuff_small_head of size 640\nThe buggy address is located 194 bytes inside of\nfreed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)\n\nAs commit f855691975bb (\"xfrm6: Fix the nexthdr offset in\n_decode_session6.\") showed, xfrm_decode_session was originally intended\nonly for the receive path. IP6CB(skb)-\u003enhoff is not set during\ntransmission. Therefore, set the cb field in the skb to 0 before\nsending packets."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:52:11.135Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f0ab8d52ee0062b28367dea23c29e254a26d7db"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa6c6c04f6c9b21b315023f487e5a07ae7fcf647"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb47e612e59c358c3968a92f90dd36c78c9a2106"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1639a82ce14af76b6419778d343ccbff86ee626"
        },
        {
          "url": "https://git.kernel.org/stable/c/55ad2309205cc00c585344374c7472420e1b2c12"
        },
        {
          "url": "https://git.kernel.org/stable/c/c070688bfbe7759e61e697e421b2a331b0dd74bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fd41f1ba638938c9a1195d09bc6fa3be2712f25"
        }
      ],
      "title": "ip6_vti: fix slab-use-after-free in decode_session6",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53821",
    "datePublished": "2025-12-09T01:29:34.073Z",
    "dateReserved": "2025-12-09T01:27:17.824Z",
    "dateUpdated": "2026-05-11T19:52:11.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53821",
      "date": "2026-09-17",
      "epss": "0.00257",
      "percentile": "0.176"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53821\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:20.877\",\"lastModified\":\"2026-06-17T06:46:07.850\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip6_vti: fix slab-use-after-free in decode_session6\\n\\nWhen ipv6_vti device is set to the qdisc of the sfb type, the cb field\\nof the sent skb may be modified during enqueuing. Then,\\nslab-use-after-free may occur when ipv6_vti device sends IPv6 packets.\\n\\nThe stack information is as follows:\\nBUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890\\nRead of size 1 at addr ffff88802e08edc2 by task swapper/0/0\\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\\nCall Trace:\\n\u003cIRQ\u003e\\ndump_stack_lvl+0xd9/0x150\\nprint_address_description.constprop.0+0x2c/0x3c0\\nkasan_report+0x11d/0x130\\ndecode_session6+0x103f/0x1890\\n__xfrm_decode_session+0x54/0xb0\\nvti6_tnl_xmit+0x3e6/0x1ee0\\ndev_hard_start_xmit+0x187/0x700\\nsch_direct_xmit+0x1a3/0xc30\\n__qdisc_run+0x510/0x17a0\\n__dev_queue_xmit+0x2215/0x3b10\\nneigh_connected_output+0x3c2/0x550\\nip6_finish_output2+0x55a/0x1550\\nip6_finish_output+0x6b9/0x1270\\nip6_output+0x1f1/0x540\\nndisc_send_skb+0xa63/0x1890\\nndisc_send_rs+0x132/0x6f0\\naddrconf_rs_timer+0x3f1/0x870\\ncall_timer_fn+0x1a0/0x580\\nexpire_timers+0x29b/0x4b0\\nrun_timer_softirq+0x326/0x910\\n__do_softirq+0x1d4/0x905\\nirq_exit_rcu+0xb7/0x120\\nsysvec_apic_timer_interrupt+0x97/0xc0\\n\u003c/IRQ\u003e\\nAllocated by task 9176:\\nkasan_save_stack+0x22/0x40\\nkasan_set_track+0x25/0x30\\n__kasan_slab_alloc+0x7f/0x90\\nkmem_cache_alloc_node+0x1cd/0x410\\nkmalloc_reserve+0x165/0x270\\n__alloc_skb+0x129/0x330\\nnetlink_sendmsg+0x9b1/0xe30\\nsock_sendmsg+0xde/0x190\\n____sys_sendmsg+0x739/0x920\\n___sys_sendmsg+0x110/0x1b0\\n__sys_sendmsg+0xf7/0x1c0\\ndo_syscall_64+0x39/0xb0\\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\\nFreed by task 9176:\\nkasan_save_stack+0x22/0x40\\nkasan_set_track+0x25/0x30\\nkasan_save_free_info+0x2b/0x40\\n____kasan_slab_free+0x160/0x1c0\\nslab_free_freelist_hook+0x11b/0x220\\nkmem_cache_free+0xf0/0x490\\nskb_free_head+0x17f/0x1b0\\nskb_release_data+0x59c/0x850\\nconsume_skb+0xd2/0x170\\nnetlink_unicast+0x54f/0x7f0\\nnetlink_sendmsg+0x926/0xe30\\nsock_sendmsg+0xde/0x190\\n____sys_sendmsg+0x739/0x920\\n___sys_sendmsg+0x110/0x1b0\\n__sys_sendmsg+0xf7/0x1c0\\ndo_syscall_64+0x39/0xb0\\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\\nThe buggy address belongs to the object at ffff88802e08ed00\\nwhich belongs to the cache skbuff_small_head of size 640\\nThe buggy address is located 194 bytes inside of\\nfreed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)\\n\\nAs commit f855691975bb (\\\"xfrm6: Fix the nexthdr offset in\\n_decode_session6.\\\") showed, xfrm_decode_session was originally intended\\nonly for the receive path. IP6CB(skb)-\u003enhoff is not set during\\ntransmission. Therefore, set the cb field in the skb to 0 before\\nsending packets.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/ip6_vti.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"0f0ab8d52ee0062b28367dea23c29e254a26d7db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"fa6c6c04f6c9b21b315023f487e5a07ae7fcf647\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"eb47e612e59c358c3968a92f90dd36c78c9a2106\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"a1639a82ce14af76b6419778d343ccbff86ee626\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"55ad2309205cc00c585344374c7472420e1b2c12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"c070688bfbe7759e61e697e421b2a331b0dd74bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f855691975bb06373a98711e4cfe2c224244b536\",\"lessThan\":\"9fd41f1ba638938c9a1195d09bc6fa3be2712f25\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/ip6_vti.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.324\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.293\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.255\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.192\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.128\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.47\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.12\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f0ab8d52ee0062b28367dea23c29e254a26d7db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/55ad2309205cc00c585344374c7472420e1b2c12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9fd41f1ba638938c9a1195d09bc6fa3be2712f25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a1639a82ce14af76b6419778d343ccbff86ee626\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c070688bfbe7759e61e697e421b2a331b0dd74bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb47e612e59c358c3968a92f90dd36c78c9a2106\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa6c6c04f6c9b21b315023f487e5a07ae7fcf647\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T20:03:36+00:00",
      "cve": "CVE-2023-53821",
      "id": "CVE-2023-53821",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "1057",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ip6_vti: fix slab-use-after-free in decode_session6",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53821.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.