CVE-2023-53338
A critical flaw in the Linux kernel allows attackers to cause a use‑after‑free and crash the system by manipulating BPF packet‑processing return values. The bug occurs when certain BPF operations return values that are incorrectly treated as normal, leading to freed packet buffers being reused. The issue has been fixed in the kernel by correcting how these return values are handled.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (all versions before the fix) on any system that uses BPF packet processing.
Real-world impact
An attacker could crash the kernel, causing a denial of service, and potentially gain further privileges if the crash leads to privilege escalation.
Why this severity
The CVSS score of 9.8 reflects the high impact of a complete denial of service, the lack of authentication or user interaction required, and the fact that the vulnerability can be exploited remotely with no special privileges.
What to do about it
- 01Update the Linux kernel to a version that includes the fix.
NVD description
Timeline
- Sep 17, 2025 · Sep 17, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/065d5f17096ec91611…patch
- git.kernel.org/stable/c/29b22badb7a84b783e…patch
- git.kernel.org/stable/c/65583f9e070db7bece…patch
- git.kernel.org/stable/c/67f8f2bae8e7ac72e0…patch
- git.kernel.org/stable/c/a97f221651fcdc8911…patch
- git.kernel.org/stable/c/d68c17402442f5f494…patch
- git.kernel.org/stable/c/e3f647e4b642f9f6d3…patch