Critical 9.8Published Oct 1, 2025

CVE-2023-53517tipc: do not update mtu if msg_max is too small in mtu negotiation

Updated under an hour ago (2026-10-19 06:25 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, without checking for the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then n->links[bearer_id].mtu is set to 4294967228, which is a overflow of '4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss(). With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning: tipc: Too large msg, purging xmit list 1 5 0 40 4! tipc: Too large msg, purging xmit list 1 15 0 60 4! And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in named_distribute(), and when purging it in tipc_link_xmit(), a crash was even caused: general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19 RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0 Call Trace: <IRQ> skb_release_data+0xf9/0x1d0 kfree_skb_reason+0x40/0x100 tipc_link_xmit+0x57a/0x740 [tipc] tipc_node_xmit+0x16c/0x5c0 [tipc] tipc_named_node_up+0x27f/0x2c0 [tipc] tipc_node_write_unlock+0x149/0x170 [tipc] tipc_rcv+0x608/0x740 [tipc] tipc_udp_recv+0xdc/0x1f0 [tipc] udp_queue_rcv_one_skb+0x33e/0x620 udp_unicast_rcv_skb.isra.72+0x75/0x90 __udp4_lib_rcv+0x56d/0xc20 ip_protocol_deliver_rcu+0x100/0x2d0 This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(), and not updating mtu if it is too small.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ed193ece2649c194a87a9d8470195760d367c075 before 2bd4ff4ffb92113f8acd04dbaed83269172c24b4; from ed193ece2649c194a87a9d8470195760d367c075 before 575e84d90a74c0b091b3417ba763ebb237aa0a8c; from ed193ece2649c194a87a9d8470195760d367c075 before 259683001d7e879fea4b42084fb6560dd9408a7e; from ed193ece2649c194a87a9d8470195760d367c075 before 1dd7ae5e0cf5a56e513f7ab7ab9570b7496281d2; from ed193ece2649c194a87a9d8470195760d367c075 before 56077b56cd3fb78e1c8619e29581ba25a5c55e86	CNA record
linux linux_kernel linux:linux_kernel	from 4.1 before 5.10.181; from 5.11 before 5.15.113; from 5.16 before 6.1.30; from 6.2 before 6.3.4; 6.4; 6.4	NVD

References

https://git.kernel.org/stable/c/2bd4ff4ffb92113f8acd04dbaed83269172c24b4patch
https://git.kernel.org/stable/c/575e84d90a74c0b091b3417ba763ebb237aa0a8cpatch
https://git.kernel.org/stable/c/259683001d7e879fea4b42084fb6560dd9408a7epatch
https://git.kernel.org/stable/c/1dd7ae5e0cf5a56e513f7ab7ab9570b7496281d2patch
https://git.kernel.org/stable/c/56077b56cd3fb78e1c8619e29581ba25a5c55e86patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.