CVE-2023-53669tcp: fix skb_copy_ubufs() vs BIG TCP
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7c4e983c4f3cf94fcd879730c6caa877e0768a4d before 7fa93e39fbb0566019c388a8038a4d58552e0910; 7c4e983c4f3cf94fcd879730c6caa877e0768a4d builds before 3c77a377877acbaf03cd7caa21d3644a5dd16301; from 7c4e983c4f3cf94fcd879730c6caa877e0768a4d before 9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f; from 7c4e983c4f3cf94fcd879730c6caa877e0768a4d before 7e692df3933628d974acb9f5b334d2b3e885e2a6 | CNA record |
linux linux_kernel linux:linux_kernel | from 5.19 before 6.1.29; from 6.2 before 6.2.16; from 6.3 before 6.3.3 | NVD |
References
- https://git.kernel.org/stable/c/7fa93e39fbb0566019c388a8038a4d58552e0910patch
- https://git.kernel.org/stable/c/3c77a377877acbaf03cd7caa21d3644a5dd16301patch
- https://git.kernel.org/stable/c/9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328fpatch
- https://git.kernel.org/stable/c/7e692df3933628d974acb9f5b334d2b3e885e2a6patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.