CVE-2023-53669

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix skb_copy_ubufs() vs BIG TCP

David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB.

skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages.

This assumption broke when BIG TCP was able to put up to 512 KB per skb.

We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000.

A solution is to use higher order pages if needed.

v2: add missing __GFP_COMP, or we leak memory.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, < 7fa93e39fbb0566019c388a8038a4d58552e0910; >= 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, < 3c77a377877acbaf03cd7caa21d3644a5dd16301; >= 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, < 9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f; >= 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, < 7e692df3933628d974acb9f5b334d2b3e885e2a6
LinuxLinux5.19

References

Timeline

Published
Oct 7, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-53677.8A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copyiCVE-2023-536705.5In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix dev_pm_qos memleak Call dev_pm_qos_hide_latency_toleranCVE-2023-536715.5In the Linux kernel, the following vulnerability has been resolved: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL Commit 99CVE-2023-536725.5In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref CVE-2023-536737.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn InCVE-2023-536745.5In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifierCVE-2023-536757.1In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possiCVE-2023-536767.8In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()CVE-2023-536775.5In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leaks in i915 selftests This patch fixes memory lCVE-2023-536785.5In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix system suspend without fbdev being initialized If fbdev CVE-2023-536795.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt7601u: fix an integer underflow Fix an integer underflow that CVE-2023-53686.5On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file w
CVE-2023-53669: Medium severity, CVSS 5.5 | Vulnix