In the Linux kernel, the following vulnerability has been resolved:

tcp: fix skb_copy_ubufs() vs BIG TCP

David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
using hugepages, and skb length bigger than ~68 KB.

skb_copy_ubufs() assumed it could copy all payload using up to
MAX_SKB_FRAGS order-0 pages.

This assumption broke when BIG TCP was able to put up to 512 KB per skb.

We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
and limit gso_max_size to 180000.

A solution is to use higher order pages if needed.

v2: add missing __GFP_COMP, or we leak memory.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7c4e983c4f3cf94fcd879730c6caa877e0768a4d affected
< 7fa93e39fbb0566019c388a8038a4d58552e0910
7c4e983c4f3cf94fcd879730c6caa877e0768a4d affected
< 3c77a377877acbaf03cd7caa21d3644a5dd16301
7c4e983c4f3cf94fcd879730c6caa877e0768a4d affected
< 9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f
7c4e983c4f3cf94fcd879730c6caa877e0768a4d affected
< 7e692df3933628d974acb9f5b334d2b3e885e2a6
Linux Linux affected
Version Status Constraints
5.19 affected
—
0 unaffected
< 5.19
6.1.29 unaffected
≤ 6.1.*
6.2.16 unaffected
≤ 6.2.*
6.3.3 unaffected
≤ 6.3.*
6.4 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions
Linux Linux Kernel — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3c77a377877acbaf03cd7caa21d3644a5dd16301 cve-icon cve-icon
https://git.kernel.org/stable/c/7e692df3933628d974acb9f5b334d2b3e885e2a6 cve-icon cve-icon
https://git.kernel.org/stable/c/7fa93e39fbb0566019c388a8038a4d58552e0910 cve-icon cve-icon
https://git.kernel.org/stable/c/9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025100705-CVE-2023-53669-f81f@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53669 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53669 cve-icon
History

Tue, 03 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Wed, 08 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 08 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 07 Oct 2025 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.
Title tcp: fix skb_copy_ubufs() vs BIG TCP
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-10-07T15:21:26.896Z

Reserved: 2025-10-07T15:16:59.663Z

Link: CVE-2023-53669

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-10-07T16:15:50.770

Modified: 2026-02-26T23:14:23.720

Link: CVE-2023-53669

cve-icon Redhat

Severity : Important

Publid Date: 2025-10-07T00:00:00Z

Links: CVE-2023-53669 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-08T13:35:36Z

Weaknesses