PT-2025-13332 · Linux+4 · Linux Kernel+4

Published 2023-01-21 · Updated 2025-09-29 · CVE-2023-52986

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, related to the bpf and sockmap functionality. When a listening socket is linked to a sockmap, its sk prot is overridden to point to one of the struct proto variants in tcp bpf prots. However, when a child socket is cloned from a TCP listener, it may inherit the wrong sk prot, leading to issues such as infinite recursion on close. The vulnerability arises from the fact that the check in tcp bpf clone only detects the TCP BPF BASE proto variant, rather than all variants in tcp bpf prots.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Infinite Loop

Weakness Enumeration

CWE-674

CWE-835

Related Identifiers

ALSA-2025_16880

BDU:2025-06238

CVE-2023-52986

OPENSUSE-SU-2025_01620-1

OPENSUSE-SU-2025_01640-1

RHSA-2023:6583

RHSA-2023_6583

SUSE-SU-2025:01620-1

SUSE-SU-2025:01640-1

SUSE-SU-2025_01620-1

Affected Products

Astra Linux

Linux Kernel

Red Hat

Red Os

Suse

References · 114

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52986.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:01640-1 · Vendor Advisory
• https://git.kernel.org/stable/c/c681d7a4ed3d360de0574f4d6b7305a8de8dc54f · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-52986 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06238 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52986 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01620-1 · Vendor Advisory
• https://git.kernel.org/stable/c/9bd6074e1872d22190a8da30e796cbf937d334f0 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52986 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52986 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52986 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-52986 · Vendor Advisory
• https://git.kernel.org/stable/c/12b0ec7c6953e1602957926439e5297095d7d065 · Patch
• https://git.kernel.org/stable/c/ddce1e091757d0259107c6c0c7262df201de2b66 · Patch