CVE-2023-53499virtio_net: Fix error unwinding of XDP initialization
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | 754b8a21a96d5f11712245aef907149606b323ae builds before 6a7690f2bd178eee80f33411ae32e543ae66379c; 754b8a21a96d5f11712245aef907149606b323ae builds before 73f53bc295727a3cdbd9d6bcdfaa239258970cf4; from 754b8a21a96d5f11712245aef907149606b323ae before 037768b28e3752c07d63d1c72a651a6775b080bb; from 754b8a21a96d5f11712245aef907149606b323ae before 5306623a9826aa7d63b32c6a3803c798a765474d | CNA record |
linux linux_kernel linux:linux_kernel | from 4.16 before 5.15.113; from 5.16 before 6.1.30; from 6.2 before 6.3.4; 6.4; 6.4 | NVD |
References
- https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379cpatch
- https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4patch
- https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bbpatch
- https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474dpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.