In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/065d5f17096ec9161180e2c890afdff4dc6125f2 cve-icon cve-icon
https://git.kernel.org/stable/c/29b22badb7a84b783e3a4fffca16f7768fb31205 cve-icon cve-icon
https://git.kernel.org/stable/c/65583f9e070db7bece20710cfa2e3daeb0b831d9 cve-icon cve-icon
https://git.kernel.org/stable/c/67f8f2bae8e7ac72e09def2b667e44704c4d1ee1 cve-icon cve-icon
https://git.kernel.org/stable/c/a97f221651fcdc891166e9bc270e3d9bfa5a0080 cve-icon cve-icon
https://git.kernel.org/stable/c/d68c17402442f5f494a2c3ebde5cb82f6aa9160a cve-icon cve-icon
https://git.kernel.org/stable/c/e3f647e4b642f9f6d32795a16f92c116c138d2af cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025091718-CVE-2023-53338-8224@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53338 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53338 cve-icon
History

Thu, 18 Sep 2025 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 18 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 17 Sep 2025 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.
Title lwt: Fix return values of BPF xmit ops
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-17T14:56:32.302Z

Updated: 2025-09-17T14:56:32.302Z

Reserved: 2025-09-16T16:08:59.565Z

Link: CVE-2023-53338

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-17T15:15:36.913

Modified: 2025-09-18T13:43:34.310

Link: CVE-2023-53338

cve-icon Redhat

Severity : Low

Publid Date: 2025-09-17T00:00:00Z

Links: CVE-2023-53338 - Bugzilla