PT-2025-13337 · Linux+4 · Linux Kernel+4

Published 2023-01-30 · Updated 2025-09-29 · CVE-2023-52991

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference issue has been identified in the Linux kernel. This issue occurs when the frag list is pulled into the linear area, leaving frag list as NULL, which can trigger a NULL pointer dereference and panic the kernel. The problem is related to the UDP listified GRO, which relies on frag list being untouched when passing through the network stack. The issue can be resolved by reversing the test condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2025-06269

CESA-2023_7077

CVE-2023-52991

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Red Os

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52991.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52991 · Vendor Advisory
• https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d · Patch
• https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54 · Patch
• https://bdu.fstec.ru/vul/2025-06269 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52991 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-52991 · Security Note
• https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-52991 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52991 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-52991 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52991 · Vendor Advisory
• https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6 · Patch
• https://access.redhat.com/security/cve/CVE-2023-52991 · Note