CVE-2023-52991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-52991
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52991.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52991
Downstream
Published
2025-03-27T16:43:26.991Z
Modified
2026-04-02T09:43:32.414652Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
net: fix NULL pointer in skb_segment_list
Details

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer in skbsegmentlist

Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on fraglist being untouched when passing through the network stack. This assumption can be broken sometimes, where fraglist itself gets pulled into linear area, leaving frag_list being NULL. When this happens it can trigger following NULL pointer dereference, and panic the kernel. Reverse the test condition should fix it.

[19185.577801][ C1] BUG: kernel NULL pointer dereference, address: ... [19185.663775][ C1] RIP: 0010:skbsegmentlist+0x1cc/0x390 ... [19185.834644][ C1] Call Trace: [19185.841730][ C1] <TASK> [19185.848563][ C1] __udpgsosegment+0x33e/0x510 [19185.857370][ C1] inet_gsosegment+0x15b/0x3e0 [19185.866059][ C1] skbmacgsosegment+0x97/0x110 [19185.874939][ C1] __skbgsosegment+0xb2/0x160 [19185.883646][ C1] udpqueuercvskb+0xc3/0x1d0 [19185.892319][ C1] udpunicastrcvskb+0x75/0x90 [19185.900979][ C1] ipprotocoldeliverrcu+0xd2/0x200 [19185.910003][ C1] iplocaldeliverfinish+0x44/0x60 [19185.918757][ C1] __netifreceiveskbonecore+0x8b/0xa0 [19185.927834][ C1] process_backlog+0x88/0x130 [19185.935840][ C1] __napipoll+0x27/0x150 [19185.943447][ C1] netrxaction+0x27e/0x5f0 [19185.951331][ C1] ? mlx5cqtaskletcb+0x70/0x160 [mlx5_core] [19185.960848][ C1] __dosoftirq+0xbc/0x25d [19185.968607][ C1] irqexitrcu+0x83/0xb0 [19185.976247][ C1] commoninterrupt+0x43/0xa0 [19185.984235][ C1] asmcommoninterrupt+0x22/0x40 ... [19186.094106][ C1] </TASK>

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52991.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3a1296a38d0cf62bffb9a03c585cbd5dbf15d596
Fixed
6446369fb9f083ce032448c5047da08e298b22e6
Fixed
046de74f9af92ae9ffce75fa22a1795223f4fb54
Fixed
888dad6f3e85e3b2f8389bd6478f181efc72534d
Fixed
876e8ca8366735a604bac86ff7e2732fc9d85d2d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52991.json"