vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-53600

tunnels: fix kasan splat when generating ipv4 pmtu error

HIGH
7.1
CVSS Score
Published: October 4, 2025 at 03:44 PM UTC
Updated: October 15, 2026 at 10:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
5.11 ≤ v < 5.15.1275.16 ≤ v < 6.1.465.9 ≤ v < 5.10.1916.2 ≤ v < 6.4.114cb47a8644cc9eb8ec81190a50e79e6530d0297f6.56.5 rc16.5 rc26.5 rc36.5 rc46.5 rc5
Vendor states this is fixed in 5850c391fd7e25662334cb3cbf29a62bcbff1084 (fixed)
Vendor states this is fixed in 6a7ac3d20593865209dceb554d8b3f094c6bd940 (fixed)
Vendor states this is fixed in da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc (fixed)
Vendor states this is fixed in e95808121953410db8c59f0abfde70ac0d34222c (fixed)
Vendor states this is fixed in fe6a9f7516735be9fdabab00e47ef7a3403a174d (fixed)
Vendor states this is fixed in 5.10.191 (unaffected)
Vendor states this is fixed in 5.15.127 (unaffected)
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.46 (unaffected)
Vendor states this is fixed in 6.4.11 (unaffected)
Vendor states this is fixed in 6.5 (unaffected)

References (5)

Patch
Source: cverecord
https://git.kernel.org/stable/c/5850c391fd7e25662334cb3cbf29a62bcbff1084
Patch
Source: cverecord
https://git.kernel.org/stable/c/e95808121953410db8c59f0abfde70ac0d34222c
Patch
Source: cverecord
https://git.kernel.org/stable/c/da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc
Patch
Source: cverecord
https://git.kernel.org/stable/c/fe6a9f7516735be9fdabab00e47ef7a3403a174d
Patch
Source: cverecord
https://git.kernel.org/stable/c/6a7ac3d20593865209dceb554d8b3f094c6bd940

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGH[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card