CVE-2023-53821
Description
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: fix slab-use-after-free in decode_session6
When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace:
dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0
Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In the Linux kernel, ip6_vti device with sfb qdisc can cause a slab-use-after-free in decode_session6, leading to potential memory corruption.
Vulnerability
Overview
CVE-2023-53821 is a use-after-free vulnerability in the Linux kernel's IPv6 Virtual Tunnel Interface (ip6_vti) driver. The bug occurs in the decode_session6 function when an IPsec helper function when an ip6_vti device is configured with a Stochastic Fair Blue (sfb) qdisc. During packet enqueuing, the sfb qdisc modifies the skb's control buffer (cb) field, which can cause the skb to be freed prematurely. When decode_session6 later reads from the freed skb's cb, a slab-use-after-free condition arises, as demonstrated by the KASAN report in the kernel commit log [1][2].
Exploitation
An attacker can trigger this vulnerability by sending crafted IPv6 packets through an ip6_vti tunnel that has an sfb qdisc attached. The attack requires the ability to send network traffic to a system using such a configuration. No special privileges are needed beyond network access, as the vulnerable code path is reachable from the network stack during normal packet processing. The kernel's KASAN report shows the read of size 1 at a freed address, confirming the use-after-free [1].
Impact
A successful exploit could lead to memory corruption, potentially allowing an attacker to crash the system (denial of service) or, in more severe cases, achieve arbitrary code execution in kernel context. The vulnerability is classified with a CVSS score indicating high severity, as it can be triggered remotely and affects kernel memory safety [1].
Mitigation
The Linux kernel community has addressed this vulnerability in multiple stable kernel updates. The fix involves ensuring that the skb's cb field is properly preserved or that decode_session6 does not access freed memory. Patches are available in commits such as 9fd41f1ba638, a1639a82ce14, 55ad2309205c, and c070688bfbe7 [1][2][3][4]. Users should apply the latest kernel updates from their distribution to remediate this issue.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3Patches
80f0ab8d52ee0fa6c6c04f6c9eb47e612e59cec23b25e5687a1639a82ce1455ad2309205cc070688bfbe79fd41f1ba638Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- git.kernel.org/stable/c/0f0ab8d52ee0062b28367dea23c29e254a26d7dbnvd
- git.kernel.org/stable/c/55ad2309205cc00c585344374c7472420e1b2c12nvd
- git.kernel.org/stable/c/9fd41f1ba638938c9a1195d09bc6fa3be2712f25nvd
- git.kernel.org/stable/c/a1639a82ce14af76b6419778d343ccbff86ee626nvd
- git.kernel.org/stable/c/c070688bfbe7759e61e697e421b2a331b0dd74bcnvd
- git.kernel.org/stable/c/eb47e612e59c358c3968a92f90dd36c78c9a2106nvd
- git.kernel.org/stable/c/ec23b25e5687dbd644c0f57bcb6af22dd5a6dd36nvd
- git.kernel.org/stable/c/fa6c6c04f6c9b21b315023f487e5a07ae7fcf647nvd
News mentions
0No linked articles in our index yet.