Log in Start free

Vulnerability · Published Dec 30, 2025 · Assigned by Linux

CVE-2023-54193net/sched: cls_api: remove block_cb from driver_list before freeing

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 94.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo->cb_list on error. However, by that time the flow_block_cb instances are already in the driver list because driver ndo_setup_tc() callback is called before that up the call chain in tcf_block_offload_cmd(). This leaves dangling pointers to freed objects in the list and causes use-after-free[0]. Fix it by also removing flow_block_cb instances from driver_list before deallocating them. [0]: [ 279.868433] ================================================================== [ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0 [ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 [ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4 [ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 279.876295] Call Trace: [ 279.876882] <TASK> [ 279.877413] dump_stack_lvl+0x33/0x50 [ 279.878198] print_report+0xc2/0x610 [ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.879994] kasan_report+0xae/0xe0 [ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core] [ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0 [ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0 [ 279.885037] ? tcf_block_setup+0x6b0/0x6b0 [ 279.885901] ? mutex_lock+0x7d/0xd0 [ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0 [ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress] [ 279.888846] tcf_block_get_ext+0x61c/0x1200 [ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress] [ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress] [ 279.891701] qdisc_create+0x401/0xea0 [ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470 [ 279.893473] tc_modify_qdisc+0x6f7/0x16d0 [ 279.894344] ? tc_get_qdisc+0xac0/0xac0 [ 279.895213] ? mutex_lock+0x7d/0xd0 [ 279.896005] ? __mutex_lock_slowpath+0x10/0x10 [ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0 [ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.898672] ? __sys_sendmsg+0xb5/0x140 [ 279.899494] ? do_syscall_64+0x3d/0x90 [ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.901337] ? kasan_save_stack+0x2e/0x40 [ 279.902177] ? kasan_save_stack+0x1e/0x40 [ 279.903058] ? kasan_set_track+0x21/0x30 [ 279.903913] ? kasan_save_free_info+0x2a/0x40 [ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0 [ 279.905741] ? kmem_cache_free+0x179/0x400 [ 279.906599] netlink_rcv_skb+0x12c/0x360 [ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.908360] ? netlink_ack+0x1550/0x1550 [ 279.909192] ? rhashtable_walk_peek+0x170/0x170 [ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390 [ 279.911086] ? _copy_from_iter+0x3d6/0xc70 [ 279.912031] netlink_unicast+0x553/0x790 [ 279.912864] ? netlink_attachskb+0x6a0/0x6a0 [ 279.913763] ? netlink_recvmsg+0x416/0xb50 [ 279.914627] netlink_sendmsg+0x7a1/0xcb0 [ 279.915473] ? netlink_unicast+0x790/0x790 [ 279.916334] ? iovec_from_user.part.0+0x4d/0x220 [ 279.917293] ? netlink_unicast+0x790/0x790 [ 279.918159] sock_sendmsg+0xc5/0x190 [ 279.918938] ____sys_sendmsg+0x535/0x6b0 [ 279.919813] ? import_iovec+0x7/0x10 [ 279.920601] ? kernel_sendmsg+0x30/0x30 [ 279.921423] ? __copy_msghdr+0x3c0/0x3c0 [ 279.922254] ? import_iovec+0x7/0x10 [ 279.923041] ___sys_sendmsg+0xeb/0x170 [ 279.923854] ? copy_msghdr_from_user+0x110/0x110 [ 279.924797] ? ___sys_recvmsg+0xd9/0x130 [ 279.925630] ? __perf_event_task_sched_in+0x183/0x470 [ 279.926656] ? ___sys_sendmsg+0x170/0x170 [ 279.927529] ? ctx_sched_in+0x530/0x530 [ 279.928369] ? update_curr+0x283/0x4f0 [ 279.929185] ? perf_event_update_userpage+0x570/0x570 [ 279.930201] ? __fget_light+0x57/0x520 [ 279.931023] ? __switch_to+0x53d/0xe70 [ 27 ---truncated---

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.37-1DEBIAN-CVE-2023-54193
Debian:13linux6.3.7-1DEBIAN-CVE-2023-54193
Debian:14linux6.3.7-1DEBIAN-CVE-2023-54193
Ubuntu:22.04:LTSlinux5.15.0-83.92UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-aws5.15.0-1044.49UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure5.15.0-1046.53UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1046.53.1UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gcp5.15.0-1041.49UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gke5.15.0-1041.46UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1027.32UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-ibm5.15.0-1037.40UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1039.45UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-kvm5.15.0-1041.46UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-83.92UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1032.32UBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1017.17UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1004.4UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oracle5.15.0-1042.48UBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-raspi5.15.0-1037.40UBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-54193
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1025.29UBUNTU-CVE-2023-54193

Affected products (as reported)

VendorProductVersions
Linux Linux 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before cc5fe387c6294d0471cb7ed064efac97fac65ccc59094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before 7311c8be3755611bf6edea4dfbeb190b4bdd489f59094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before cb145932fcf6814e7e95e467eb70e7849a845ae959094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before 55866fe3fded3ce94ac3fc1bb3dfce654282f48359094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before 26aec72429a05e917d574eca0efc5306c63a886259094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before 7b7a74ed303d532fb73ae4b1697f16a0fea89cd059094b1e5094c7e50a3d2912202fd30b6a1dadf8 – before da94a7781fc3c92e7df7832bc2746f4d39bc624e
Linux Linux 5.3

References