CVE-2023-54094

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54094", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.516Z", "datePublished": "2025-12-24T13:06:22.446Z", "dateUpdated": "2026-10-15T21:41:39.521Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:11.783Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent skb corruption on frag list segmentation\n\nIan reported several skb corruptions triggered by rx-gro-list,\ncollecting different oops alike:\n\n[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 62.631083] #PF: supervisor read access in kernel mode\n[ 62.636312] #PF: error_code(0x0000) - not-present page\n[ 62.641541] PGD 0 P4D 0\n[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364\n[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022\n[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858\n./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261\nnet/ipv4/udp_offload.c:277)\n[ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246\n[ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000\n[ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4\n[ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9\n[ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2\n[ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9\n[ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000)\nknlGS:0000000000000000\n[ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0\n[ 62.749948] Call Trace:\n[ 62.752498] <TASK>\n[ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)\n[ 62.787605] skb_mac_gso_segment (net/core/gro.c:141)\n[ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))\n[ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862\nnet/core/dev.c:3659)\n[ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710)\n[ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)\n[ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)\nnet/netfilter/core.c:626)\n[ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)\n[ 62.825652] maybe_deliver (net/bridge/br_forward.c:193)\n[ 62.829420] br_flood (net/bridge/br_forward.c:233)\n[ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)\n[ 62.837403] br_handle_frame (net/bridge/br_input.c:298\nnet/bridge/br_input.c:416)\n[ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)\n[ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)\n[ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638\nnet/core/dev.c:5727)\n[ 62.876795] napi_complete_done (./include/linux/list.h:37\n./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)\n[ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)\n[ 62.893534] __napi_poll (net/core/dev.c:6498)\n[ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89\nnet/core/dev.c:6640)\n[ 62.905276] kthread (kernel/kthread.c:379)\n[ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)\n[ 62.917119] </TASK>\n\nIn the critical scenario, rx-gro-list GRO-ed packets are fed, via a\nbridge, both to the local input path and to an egress device (tun).\n\nThe segmentation of such packets unsafely writes to the cloned skbs\nwith shared heads.\n\nThis change addresses the issue by uncloning as needed the\nto-be-segmented skbs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached purely by processing packets received from the network \u2014 GRO aggregation on an ingress NIC with rx-gro-list creates the SKB_GSO_FRAGLIST skb, a bridge clones it, and software segmentation on egress corrupts the shared head. No local access is needed; the attacker only sends UDP/TCP frames.\nAC:L - The attacker deterministically creates both preconditions by sending back-to-back same-flow UDP/TCP packets (forcing GRO fraglist aggregation) addressed to an unknown-unicast/broadcast/multicast MAC (forcing br_flood to skb_clone); no race must be won, no memory layout must be guessed, and the corruption of the shared skb_shared_info occurs on every such packet.\nPR:N - The entire path is in the NAPI/softirq receive and bridge-forwarding datapath, executed before any authentication or socket ownership check; an unauthenticated off-host attacker on the network needs no credentials on the target.\nUI:N - Triggering requires no action by any local user or administrator \u2014 ordinary inbound traffic on an already-configured bridged host drives the whole sequence from packet receive to segmentation.\nS:U - The corruption is confined to kernel skb/heap memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unsynchronized write to a cloned skb's shared_info leads to fraglist skbs being consumed twice and re-headed after free, so segments are built from freed heap memory and transmitted out the egress device, exposing kernel heap contents; a use-after-free of this kind gives attacker leverage over freed object contents.\nI:H - This is a memory-corruption bug by design (\"prevent skb corruption\") \u2014 it writes into a shared skb head still in use by another clone, and __udpv4_gso_segment_list_csum then writes attacker-controlled IP addresses, ports and checksums through pointers derived from a stale/freed skb, yielding a use-after-free write primitive.\nA:H - The reported and reproducible result is a kernel NULL pointer dereference oops in the NAPI kernel thread (CR2=0xc0 in __udp_gso_segment), killing the receive path and panicking on panic_on_oops systems; the concurrent double-free variant likewise crashes the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "ea438eed94ac0fe69b93ac034738823c0e989a12", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "1731234e8b60063eae858c77b55c7a88f5084353", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "7a59f29961cf97b98b02acaadf5a0b1f8dde938c", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "c329b261afe71197d9da83c1f18eb45a7e97e089", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.188", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.121", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.40", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4.5", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.4.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a"}, {"url": "https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12"}, {"url": "https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353"}, {"url": "https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c"}, {"url": "https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089"}], "title": "net: prevent skb corruption on frag list segmentation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54094", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:23.715992Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:39.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54094", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:23.715992Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:38:24.513Z"}}], "cna": {"title": "net: prevent skb corruption on frag list segmentation", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached purely by processing packets received from the network \u2014 GRO aggregation on an ingress NIC with rx-gro-list creates the SKB_GSO_FRAGLIST skb, a bridge clones it, and software segmentation on egress corrupts the shared head. No local access is needed; the attacker only sends UDP/TCP frames.\nAC:L - The attacker deterministically creates both preconditions by sending back-to-back same-flow UDP/TCP packets (forcing GRO fraglist aggregation) addressed to an unknown-unicast/broadcast/multicast MAC (forcing br_flood to skb_clone); no race must be won, no memory layout must be guessed, and the corruption of the shared skb_shared_info occurs on every such packet.\nPR:N - The entire path is in the NAPI/softirq receive and bridge-forwarding datapath, executed before any authentication or socket ownership check; an unauthenticated off-host attacker on the network needs no credentials on the target.\nUI:N - Triggering requires no action by any local user or administrator \u2014 ordinary inbound traffic on an already-configured bridged host drives the whole sequence from packet receive to segmentation.\nS:U - The corruption is confined to kernel skb/heap memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unsynchronized write to a cloned skb's shared_info leads to fraglist skbs being consumed twice and re-headed after free, so segments are built from freed heap memory and transmitted out the egress device, exposing kernel heap contents; a use-after-free of this kind gives attacker leverage over freed object contents.\nI:H - This is a memory-corruption bug by design (\"prevent skb corruption\") \u2014 it writes into a shared skb head still in use by another clone, and __udpv4_gso_segment_list_csum then writes attacker-controlled IP addresses, ports and checksums through pointers derived from a stale/freed skb, yielding a use-after-free write primitive.\nA:H - The reported and reproducible result is a kernel NULL pointer dereference oops in the NAPI kernel thread (CR2=0xc0 in __udp_gso_segment), killing the receive path and panicking on panic_on_oops systems; the concurrent double-free variant likewise crashes the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a", "versionType": "git"}, {"status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "ea438eed94ac0fe69b93ac034738823c0e989a12", "versionType": "git"}, {"status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "1731234e8b60063eae858c77b55c7a88f5084353", "versionType": "git"}, {"status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "7a59f29961cf97b98b02acaadf5a0b1f8dde938c", "versionType": "git"}, {"status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "c329b261afe71197d9da83c1f18eb45a7e97e089", "versionType": "git"}], "programFiles": ["net/core/skbuff.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.188", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.121", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.40", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.4.5", "versionType": "semver", "lessThanOrEqual": "6.4.*"}, {"status": "unaffected", "version": "6.5", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/skbuff.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a"}, {"url": "https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12"}, {"url": "https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353"}, {"url": "https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c"}, {"url": "https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent skb corruption on frag list segmentation\n\nIan reported several skb corruptions triggered by rx-gro-list,\ncollecting different oops alike:\n\n[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 62.631083] #PF: supervisor read access in kernel mode\n[ 62.636312] #PF: error_code(0x0000) - not-present page\n[ 62.641541] PGD 0 P4D 0\n[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364\n[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022\n[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858\n./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261\nnet/ipv4/udp_offload.c:277)\n[ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246\n[ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000\n[ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4\n[ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9\n[ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2\n[ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9\n[ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000)\nknlGS:0000000000000000\n[ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0\n[ 62.749948] Call Trace:\n[ 62.752498] <TASK>\n[ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)\n[ 62.787605] skb_mac_gso_segment (net/core/gro.c:141)\n[ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))\n[ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862\nnet/core/dev.c:3659)\n[ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710)\n[ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)\n[ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)\nnet/netfilter/core.c:626)\n[ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)\n[ 62.825652] maybe_deliver (net/bridge/br_forward.c:193)\n[ 62.829420] br_flood (net/bridge/br_forward.c:233)\n[ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)\n[ 62.837403] br_handle_frame (net/bridge/br_input.c:298\nnet/bridge/br_input.c:416)\n[ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)\n[ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)\n[ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638\nnet/core/dev.c:5727)\n[ 62.876795] napi_complete_done (./include/linux/list.h:37\n./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)\n[ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)\n[ 62.893534] __napi_poll (net/core/dev.c:6498)\n[ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89\nnet/core/dev.c:6640)\n[ 62.905276] kthread (kernel/kthread.c:379)\n[ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)\n[ 62.917119] </TASK>\n\nIn the critical scenario, rx-gro-list GRO-ed packets are fed, via a\nbridge, both to the local input path and to an egress device (tun).\n\nThe segmentation of such packets unsafely writes to the cloned skbs\nwith shared heads.\n\nThis change addresses the issue by uncloning as needed the\nto-be-segmented skbs."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.188", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.121", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.40", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.5", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5", "versionStartIncluding": "5.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:11.783Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54094", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:39.521Z", "dateReserved": "2025-12-24T13:02:52.516Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-24T13:06:22.446Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a", "status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "versionType": "git"}, {"lessThan": "ea438eed94ac0fe69b93ac034738823c0e989a12", "status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "versionType": "git"}, {"lessThan": "1731234e8b60063eae858c77b55c7a88f5084353", "status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "versionType": "git"}, {"lessThan": "7a59f29961cf97b98b02acaadf5a0b1f8dde938c", "status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "versionType": "git"}, {"lessThan": "c329b261afe71197d9da83c1f18eb45a7e97e089", "status": "affected", "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.188", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.121", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.40", "versionType": "semver"}, {"lessThanOrEqual": "6.4.*", "status": "unaffected", "version": "6.4.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent skb corruption on frag list segmentation\n\nIan reported several skb corruptions triggered by rx-gro-list,\ncollecting different oops alike:\n\n[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 62.631083] #PF: supervisor read access in kernel mode\n[ 62.636312] #PF: error_code(0x0000) - not-present page\n[ 62.641541] PGD 0 P4D 0\n[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364\n[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022\n[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858\n./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261\nnet/ipv4/udp_offload.c:277)\n[ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246\n[ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000\n[ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4\n[ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9\n[ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2\n[ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9\n[ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000)\nknlGS:0000000000000000\n[ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0\n[ 62.749948] Call Trace:\n[ 62.752498] <TASK>\n[ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)\n[ 62.787605] skb_mac_gso_segment (net/core/gro.c:141)\n[ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))\n[ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862\nnet/core/dev.c:3659)\n[ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710)\n[ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)\n[ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)\nnet/netfilter/core.c:626)\n[ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)\n[ 62.825652] maybe_deliver (net/bridge/br_forward.c:193)\n[ 62.829420] br_flood (net/bridge/br_forward.c:233)\n[ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)\n[ 62.837403] br_handle_frame (net/bridge/br_input.c:298\nnet/bridge/br_input.c:416)\n[ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)\n[ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)\n[ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638\nnet/core/dev.c:5727)\n[ 62.876795] napi_complete_done (./include/linux/list.h:37\n./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)\n[ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)\n[ 62.893534] __napi_poll (net/core/dev.c:6498)\n[ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89\nnet/core/dev.c:6640)\n[ 62.905276] kthread (kernel/kthread.c:379)\n[ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)\n[ 62.917119] </TASK>\n\nIn the critical scenario, rx-gro-list GRO-ed packets are fed, via a\nbridge, both to the local input path and to an egress device (tun).\n\nThe segmentation of such packets unsafely writes to the cloned skbs\nwith shared heads.\n\nThis change addresses the issue by uncloning as needed the\nto-be-segmented skbs."}], "id": "CVE-2023-54094", "lastModified": "2026-10-15T22:17:52.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54094", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:38:23.715992Z", "version": "2.0.3"}}]}, "published": "2025-12-24T13:16:11.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: prevent skb corruption on frag list segmentation", "id": "2425150", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425150"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-54094", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54094\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54094\nhttps://lore.kernel.org/linux-cve-announce/2025122408-CVE-2023-54094-e8ce@gregkh/T"], "threat_severity": "Low"}

{}