{
  "threat_severity" : "Low",
  "public_date" : "2025-10-01T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp",
    "id" : "2400741",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2400741"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-772",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ntcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.\nsyzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY\nskbs.  We can reproduce the problem with these sequences:\nsk = socket(AF_INET, SOCK_DGRAM, 0)\nsk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)\nsk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)\nsk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))\nsk.close()\nsendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets\nskb->cb->ubuf.refcnt to 1, and calls sock_hold().  Here, struct\nubuf_info_msgzc indirectly holds a refcnt of the socket.  When the\nskb is sent, __skb_tstamp_tx() clones it and puts the clone into\nthe socket's error queue with the TX timestamp.\nWhen the original skb is received locally, skb_copy_ubufs() calls\nskb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.\nThis additional count is decremented while freeing the skb, but struct\nubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is\nnot called.\nThe last refcnt is not released unless we retrieve the TX timestamped\nskb by recvmsg().  Since we clear the error queue in inet_sock_destruct()\nafter the socket's refcnt reaches 0, there is a circular dependency.\nIf we close() the socket holding such skbs, we never call sock_put()\nand leak the count, sk, and skb.\nTCP has the same problem, and commit e0c8bccd40fc (\"net: stream:\npurge sk_error_queue in sk_stream_kill_queues()\") tried to fix it\nby calling skb_queue_purge() during close().  However, there is a\nsmall chance that skb queued in a qdisc or device could be put\ninto the error queue after the skb_queue_purge() call.\nIn __skb_tstamp_tx(), the cloned skb should not have a reference\nto the ubuf to remove the circular dependency, but skb_clone() does\nnot call skb_copy_ubufs() for zerocopy skb.  So, we need to call\nskb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs().\n[0]:\nBUG: memory leak\nunreferenced object 0xffff88800c6d2d00 (size 1152):\ncomm \"syz-executor392\", pid 264, jiffies 4294785440 (age 13.044s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00  ................\n02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\nbacktrace:\n[<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024\n[<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083\n[<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline]\n[<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245\n[<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515\n[<00000000b9b11231>] sock_create net/socket.c:1566 [inline]\n[<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline]\n[<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline]\n[<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636\n[<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline]\n[<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline]\n[<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647\n[<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80\n[<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd\nBUG: memory leak\nunreferenced object 0xffff888017633a00 (size 240):\ncomm \"syz-executor392\", pid 264, jiffies 4294785440 (age 13.044s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff  .........-m.....\nbacktrace:\n[<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497\n[<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline]\n[<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596\n[<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline]\n[<00000000be626478>]\n---truncated---" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53489\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53489\nhttps://lore.kernel.org/linux-cve-announce/2025100123-CVE-2023-53489-eec5@gregkh/T" ],
  "name" : "CVE-2023-53489",
  "csaw" : false
}