CVE catalog

CVE-2023-53781

linux: CVE-2023-53781

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.14% · Oct 25, 2026

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket. However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers. The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket(). [0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) ================================================================== BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) </IRQ>

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	linux	sid	`7.2.12-1`	fixed
Debian	linux	forky	`7.2.12-1`	fixed
Debian	linux	trixie	`6.12.107-1`	fixed
Debian	linux	trixie-security	`6.12.113-1`	fixed
Debian	linux	bookworm	`6.1.176-1`	vulnerable
Debian	linux	bookworm-security	`6.1.190-1`	vulnerable
Linux	Kernel	Not reported	`6.2.12`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	linux	source	sid	`6.3.7-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	forky	`6.3.7-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	trixie	`6.3.7-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Linux	Kernel	Linux	Not reported	`6.2.12`	Not reported	CVE-2023-53781	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[bpftool]Unknown
Source package: [linux]
Details (6)
- 7.1.0+6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 7.1.0+6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[hyperv-daemons]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[intel-sdsi]Unknown
Source package: [linux]
Details (1)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
[libcpupower1]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[libcpupower-dev]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-bpf-dev]Unknown
Source package: [linux]
Details (2)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
[linux-compiler-gcc-12-x86]Unknown
Source package: [linux]
Details (2)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-config-6.1]Unknown
Source package: [linux]
Details (4)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-cpupower]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-doc]Unknown
Source package: [linux]
Details (32)
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-doc-6.1]Unknown
Source package: [linux]
Details (6)
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Affected
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common-rt]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Affected
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-50-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.176-1 · amd64 · bookworm
  Affected
  dsa · linux · debian · bookworm

Next results

Observed: Oct 24, 2026, 4:52:11 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]