Skip to content
Fencer Vulns
high 7.5

CVE-2023-52610 json

net/sched: act_ct: fix skb leak and crash on ooo frags

published 2024-03-18 2 y ago modified 2026-08-05 3 mo ago also EUVD-2023-57234

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix skb leak and crash on ooo frags

act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in:

inet_frag_reasm_prepare skb_morph

which is not straightforward.

However when frags arrive out of order, nobody unref the last frag, and all frags are leaked. The situation is even worse, as initiating packet capture can lead to a crash[0] when skb has been cloned and shared at the same time.

Fix the issue by removing skb_get() before defragmentation. act_ct returns TC_ACT_CONSUMED when defrag failed or in progress.

[0]: [ 843.804823] ------------[ cut here ]------------ [ 843.809659] kernel BUG at net/core/skbuff.c:2091! [ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP [ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 [ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 [ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 [ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 [ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 [ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 [ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 [ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 [ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 [ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 [ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 [ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 [ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 843.894229] PKRU: 55555554 [ 843.898539] Call Trace: [ 843.902772] <IRQ> [ 843.906922] ? __die_body+0x1e/0x60 [ 843.911032] ? die+0x3c/0x60 [ 843.915037] ? do_trap+0xe2/0x110 [ 843.918911] ? pskb_expand_head+0x2ac/0x300 [ 843.922687] ? do_error_trap+0x65/0x80 [ 843.926342] ? pskb_expand_head+0x2ac/0x300 [ 843.929905] ? exc_invalid_op+0x50/0x60 [ 843.933398] ? pskb_expand_head+0x2ac/0x300 [ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 [ 843.940226] ? pskb_expand_head+0x2ac/0x300 [ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 [ 843.946904] ip_defrag+0x5d4/0x870 [ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] [ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] [ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] [ 843.959657] tcf_action_exec+0xa1/0x160 [ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] [ 843.966010] ? skb_clone+0x53/0xc0 [ 843.969173] tcf_classify+0x24d/0x420 [ 843.972333] tc_run+0x8f/0xf0 [ 843.975465] __netif_receive_skb_core+0x67a/0x1080 [ 843.978634] ? dev_gro_receive+0x249/0x730 [ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 [ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 [ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] [ 843.991170] napi_complete_done+0x72/0x1a0 [ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] [ 843.997501] __napi_poll+0x25/0x1b0 [ 844.000627] net_rx_action+0x256/0x330 [ 844.003705] __do_softirq+0xb3/0x29b [ 844.006718] irq_exit_rcu+0x9e/0xc0 [ 844.009672] common_interrupt+0x86/0xa0 [ 844.012537] </IRQ> [ 844.015285] <TASK> [ 844.017937] asm_common_interrupt+0x26/0x40 [ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 [ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb ---truncated---

Patch / fix

  • Linux Linux 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
  • linux Debian 12 6.1.76-1
  • linux Debian 14, Debian 13 6.6.15-1

debian advisories DEBIAN-CVE-2023-52610

  • linux Ubuntu 22.04 LTS 5.15.0-102.112
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1057.63
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1055.63
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1054.59
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1050.53
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1054.59
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1060.69
  • linux-gkeop Ubuntu 22.04 LTS 5.15.0-1040.46

ubuntu advisories UBUNTU-CVE-2023-52610

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-kvm RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-core RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-modules RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-debug-kvm RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-debug-core RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-debug-modules RHEL 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel-rt-modules-extra RHEL 8 4.18.0-553.5.1.rt7.346.el8_10

red hat advisories RHSA-2025:22999RHSA-2025:22997RHSA-2025:22124RHSA-2025:22095RHSA-2024:3627RHSA-2024:3618

  • kernel-rt Linux Micro 6.0 6.4.0-11.1
  • kernel-source-rt Linux Micro 6.0 6.4.0-11.1
  • kernel-livepatch-MICRO-6-0-RT_Update_3 Linux Micro 6.0 1-1.2
  • kernel-source Linux Micro 6.0 6.4.0-20.1
  • kernel-default Linux Micro 6.0 6.4.0-20.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-20.1
  • kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
  • kernel-livepatch-MICRO-6-0_Update_3 Linux Micro 6.0 1-1.2

suse advisories SUSE-SU-2025:20077-1SUSE-SU-2025:20073-1SUSE-SU-2024:3592-1SUSE-SU-2024:3587-1SUSE-SU-2024:3569-1SUSE-SU-2024:3564-1

  • kernel AlmaLinux 8 4.18.0-553.5.1.el8_10
  • perf AlmaLinux 8 4.18.0-553.5.1.el8_10
  • bpftool AlmaLinux 8 4.18.0-553.5.1.el8_10
  • kernel-core AlmaLinux 8 4.18.0-553.5.1.el8_10
  • kernel-tools AlmaLinux 8 4.18.0-553.5.1.el8_10
  • python3-perf AlmaLinux 8 4.18.0-553.5.1.el8_10
  • kernel-modules AlmaLinux 8 4.18.0-553.5.1.el8_10
  • kernel-zfcpdump AlmaLinux 8 4.18.0-553.5.1.el8_10

almalinux advisories ALSA-2024:3618ALSA-2024:3627ALSA-2024:2394

  • kernel-rt Rocky Linux 8 4.18.0-553.5.1.rt7.346.el8_10
  • kernel Rocky Linux 8 4.18.0-553.5.1.el8_10

rocky linux advisories RLSA-2024:3627RLSA-2024:3618

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-52610 updated cvss 6.4

kernel: net/sched: act_ct: fix skb leak and crash on ooo frags

  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.8.8) kernel-debuginfo-common-x86_64 4.18.0-477.67.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.67.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.67.1.el8_8
    fixed: vendor fix RHSA-2024:5255
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-427.13.1.el9_4, perf 5.14.0-427.13.1.el9_4, rtla 5.14.0-427.13.1.el9_4, kernel-devel-matched 5.14.0-427.13.1.el9_4, kernel-64k-devel-matched 5.14.0-427.13.1.el9_4, kernel-debug-devel-matched 5.14.0-427.13.1.el9_4, +6 more
    fixed: vendor fix RHSA-2024:2394
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.157.1.el9_0, kernel-devel-matched 5.14.0-70.157.1.el9_0, kernel-debug-devel-matched 5.14.0-70.157.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.157.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.157.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.157.1.el9_0, +2 more
    fixed: vendor fix RHSA-2025:22999
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.148.1.el9_2, rtla 5.14.0-284.148.1.el9_2, kernel-devel-matched 5.14.0-284.148.1.el9_2, kernel-64k-devel-matched 5.14.0-284.148.1.el9_2, kernel-debug-devel-matched 5.14.0-284.148.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.148.1.el9_2, +5 more
    fixed: vendor fix RHSA-2025:22095
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.5.1.el8_10, kernel 4.18.0-553.5.1.el8_10, bpftool 4.18.0-553.5.1.el8_10, kernel-core 4.18.0-553.5.1.el8_10, kernel-tools 4.18.0-553.5.1.el8_10, python3-perf 4.18.0-553.5.1.el8_10, +15 more
    fixed: vendor fix RHSA-2024:3618
  • Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.3.0-427.13.1.el9_4, kernel 5.14.0-427.13.1.el9_4, kernel-64k 5.14.0-427.13.1.el9_4, kernel-core 5.14.0-427.13.1.el9_4, kernel-tools 5.14.0-427.13.1.el9_4, python3-perf 5.14.0-427.13.1.el9_4, +28 more
    fixed: vendor fix RHSA-2024:2394
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.119.1.el8_6, kernel 4.18.0-372.119.1.el8_6, bpftool 4.18.0-372.119.1.el8_6, kernel-core 4.18.0-372.119.1.el8_6, kernel-tools 4.18.0-372.119.1.el8_6, python3-perf 4.18.0-372.119.1.el8_6, +8 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) perf 4.18.0-372.119.1.el8_6, kernel 4.18.0-372.119.1.el8_6, bpftool 4.18.0-372.119.1.el8_6, kernel-core 4.18.0-372.119.1.el8_6, kernel-tools 4.18.0-372.119.1.el8_6, python3-perf 4.18.0-372.119.1.el8_6, +15 more
    fixed: vendor fix RHSA-2024:5692
show 13 more
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.157.1.el9_0, bpftool 5.14.0-70.157.1.el9_0, kernel-core 5.14.0-70.157.1.el9_0, kernel-tools 5.14.0-70.157.1.el9_0, python3-perf 5.14.0-70.157.1.el9_0, kernel-modules 5.14.0-70.157.1.el9_0, +14 more
    fixed: vendor fix RHSA-2025:22999
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.148.1.el9_2, kernel 5.14.0-284.148.1.el9_2, kernel-64k 5.14.0-284.148.1.el9_2, kernel-core 5.14.0-284.148.1.el9_2, kernel-tools 5.14.0-284.148.1.el9_2, python3-perf 5.14.0-284.148.1.el9_2, +28 more
    fixed: vendor fix RHSA-2025:22095
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) perf 4.18.0-477.67.1.el8_8, kernel 4.18.0-477.67.1.el8_8, bpftool 4.18.0-477.67.1.el8_8, kernel-core 4.18.0-477.67.1.el8_8, kernel-tools 4.18.0-477.67.1.el8_8, python3-perf 4.18.0-477.67.1.el8_8, +15 more
    fixed: vendor fix RHSA-2024:5255
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) perf 4.18.0-372.119.1.el8_6, kernel 4.18.0-372.119.1.el8_6, bpftool 4.18.0-372.119.1.el8_6, kernel-core 4.18.0-372.119.1.el8_6, kernel-tools 4.18.0-372.119.1.el8_6, python3-perf 4.18.0-372.119.1.el8_6, +8 more
    fixed: vendor fix RHSA-2024:5692
  • Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.5.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.5.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.5.1.el8_10
    fixed: vendor fix RHSA-2024:3618
  • Red Hat Enterprise Linux CRB (v. 9) libperf 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.13.1.el9_4
    fixed: vendor fix RHSA-2024:2394
  • Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-kvm 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-core 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-modules 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-debug-kvm 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-debug-core 4.18.0-553.5.1.rt7.346.el8_10, +4 more
    fixed: vendor fix RHSA-2024:3627
  • Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-427.13.1.el9_4, kernel-rt-kvm 5.14.0-427.13.1.el9_4, kernel-rt-core 5.14.0-427.13.1.el9_4, kernel-rt-modules 5.14.0-427.13.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.13.1.el9_4, kernel-rt-debug-core 5.14.0-427.13.1.el9_4, +6 more
    fixed: vendor fix RHSA-2024:2394
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-kvm 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-core 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-modules 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-debug-kvm 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-debug-core 5.14.0-70.157.1.rt21.229.el9_0, +4 more Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-core 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-modules 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-debug-core 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-debug-modules 5.14.0-70.157.1.rt21.229.el9_0, kernel-rt-modules-extra 5.14.0-70.157.1.rt21.229.el9_0, +2 more
    fixed: vendor fix RHSA-2025:22997
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-core 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-modules 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-debug-core 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-modules-core 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-debug-modules 5.14.0-284.148.1.rt14.433.el9_2, +4 more Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-kvm 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-core 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-modules 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-debug-kvm 5.14.0-284.148.1.rt14.433.el9_2, kernel-rt-debug-core 5.14.0-284.148.1.rt14.433.el9_2, +6 more
    fixed: vendor fix RHSA-2025:22124
  • Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-core 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-modules 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-debug-core 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-debug-modules 4.18.0-553.5.1.rt7.346.el8_10, kernel-rt-modules-extra 4.18.0-553.5.1.rt7.346.el8_10, +2 more
    fixed: vendor fix RHSA-2024:3627
  • Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-427.13.1.el9_4, kernel-rt-core 5.14.0-427.13.1.el9_4, kernel-rt-modules 5.14.0-427.13.1.el9_4, kernel-rt-debug-core 5.14.0-427.13.1.el9_4, kernel-rt-modules-core 5.14.0-427.13.1.el9_4, kernel-rt-debug-modules 5.14.0-427.13.1.el9_4, +4 more
    fixed: vendor fix RHSA-2024:2394
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux BaseOS AUS (v.8.6) kernel-doc 4.18.0-372.119.1.el8_6 Red Hat Enterprise Linux BaseOS E4S (v.8.6) kernel-doc 4.18.0-372.119.1.el8_6 Red Hat Enterprise Linux BaseOS EUS (v.8.8) kernel-headers 4.18.0-477.67.1.el8_8, kernel-cross-headers 4.18.0-477.67.1.el8_8 Red Hat Enterprise Linux BaseOS TUS (v.8.6) kernel-doc 4.18.0-372.119.1.el8_6
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.