Message-ID: <2025091856-CVE-2023-53426-9553@gregkh>
Date: Thu, 18 Sep 2025 18:04:17 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53426: xsk: Fix xsk_diag use-after-free error during socket cleanup

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xsk: Fix xsk_diag use-after-free error during socket cleanup

Fix a use-after-free error that is possible if the xsk_diag interface
is used after the socket has been unbound from the device. This can
happen either due to the socket being closed or the device
disappearing. In the early days of AF_XDP, the way we tested that a
socket was not bound to a device was to simply check if the netdevice
pointer in the xsk socket structure was NULL. Later, a better system
was introduced by having an explicit state variable in the xsk socket
struct. For example, the state of a socket that is on the way to being
closed and has been unbound from the device is XSK_UNBOUND.

The commit in the Fixes tag below deleted the old way of signalling
that a socket is unbound, setting dev to NULL. This in the belief that
all code using the old way had been exterminated. That was
unfortunately not true as the xsk diagnostics code was still using the
old way and thus does not work as intended when a socket is going
down. Fix this by introducing a test against the state variable. If
the socket is in the state XSK_UNBOUND, simply abort the diagnostic's
netlink operation.

The Linux kernel CVE team has assigned CVE-2023-53426 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15.33 with commit ad7219cd8751bd258b9d1e69ae0654ec00f71875 and fixed in 5.15.132 with commit 5979985f2d6b565b6cf0f79a62670a2855c0e96c
	Issue introduced in 5.18 with commit 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 and fixed in 6.1.54 with commit 6436973164ea5506a495f39e56be5aea375e7832
	Issue introduced in 5.18 with commit 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 and fixed in 6.5.4 with commit 595931912357fa3507e522a7f8a0a76e423c23e4
	Issue introduced in 5.18 with commit 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 and fixed in 6.6 with commit 3e019d8a05a38abb5c85d4f1e85fda964610aa14
	Issue introduced in 5.16.19 with commit d1579253ffce39986e7a6ab757ac93b2680a665f
	Issue introduced in 5.17.2 with commit 8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53426
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/xdp/xsk_diag.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5979985f2d6b565b6cf0f79a62670a2855c0e96c
	https://git.kernel.org/stable/c/6436973164ea5506a495f39e56be5aea375e7832
	https://git.kernel.org/stable/c/595931912357fa3507e522a7f8a0a76e423c23e4
	https://git.kernel.org/stable/c/3e019d8a05a38abb5c85d4f1e85fda964610aa14

Powered by blists - more mailing lists