Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-53752 — kernel

🟠 CVSS 7.8 — High ✅ No Known Exploit NVD
7.8
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

net: deal with integer overflows in kmalloc_reserve()

In the Linux kernel, the following vulnerability has been resolved:

net: deal with integer overflows in kmalloc_reserve()

Blamed commit changed:

ptr = kmalloc(size);

if (ptr)

size = ksize(ptr);

size = kmalloc_size_roundup(size);

ptr = kmalloc(size);

This allowed various crash as reported by syzbot [1]

and Kyle Zeng.

Problem is that if @size is bigger than 0x80000001,

kmalloc_size_roundup(size) returns 2^32.

kmalloc_reserve() uses a 32bit variable (obj_size),

so 2^32 is truncated to 0.

kmalloc(0) returns ZERO_SIZE_PTR which is not handled by

skb allocations.

Following trace can be triggered if a netdev->mtu is set

close to 0x7fffffff

We might in the future limit netdev->mtu to more sensible

limit (like KMALLOC_MAX_SIZE).

This patch is based on a syzbot report, and also a report

and tentative fix from Kyle Zeng.

[1]

BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline]

BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527

Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554

CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023

Call trace:

dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279

show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106

print_report+0xe4/0x4b4 mm/kasan/report.c:398

kasan_report+0x150/0x1ac mm/kasan/report.c:495

kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189

memset+0x40/0x70 mm/kasan/shadow.c:44

__build_skb_around net/core/skbuff.c:294 [inline]

__alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527

alloc_skb include/linux/skbuff.h:1316 [inline]

igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359

add_grec+0x81c/0x1124 net/ipv4/igmp.c:534

igmpv3_send_cr net/ipv4/igmp.c:667 [inline]

igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810

call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474

expire_timers kernel/time/timer.c:1519 [inline]

__run_timers+0x54c/0x710 kernel/time/timer.c:1790

run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803

_stext+0x380/0xfbc

____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79

call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891

do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84

invoke_softirq kernel/softirq.c:437 [inline]

__irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683

irq_exit_rcu+0x14/0x78 kernel/softirq.c:695

el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717

__el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724

el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729

el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Local — a local account, shell or session on the host is needed.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: High — total loss, or loss the attacker controls.
  • Integrity impact: High — total loss, or loss the attacker controls.
  • Availability impact: High — total loss, or loss the attacker controls.

Affected software

CVE-2023-53752 is recorded against 2 packages.

  • kernel (from 6.2.0 up to 6.5.3)
  • unknown

Timeline and source

Published on 8 December 2025 and last revised on 12 August 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

Other advisories for this package

kernel has other advisories on record. If you are patching this one, these are worth checking on the same host:

CVE-2023-53752 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity High
CVSS Score 7.8
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2025-12-08
Updated 2026-08-20
Modified 2026-08-12
Fix URL N/A

Affected Packages

Software From version Fixed in
kernel 6.2.0 6.5.3
unknown — —

Similar Threats

Site Security Check

Is kernel part of your stack?

CVE-2023-53752 is rated CVSS 7.8 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓