PT-2025-40720 · Linux+3 · Linux Kernel+3

Published 2021-11-09 · Updated 2025-12-04 · CVE-2023-53578

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to uninitialized variable access within the qrtr tx resume() function. The issue occurs due to an insufficient size check in qrtr endpoint post() when handling QRTR TYPE RESUME TX, leading to the use of an uninitialized variable. This condition is triggered under specific Syzbot scenarios. The qrtr tx resume() function and qrtr endpoint post() are involved in the process, and the skb->len variable requires a minimum size of sizeof(struct qrtr ctrl pkt). The vulnerability is related to the handling of network packets and the qrtr (Qualcomm Radio Transport) protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-457

Related Identifiers

ALSA-2025_16880

BDU:2026-04435

CESA-2021_4356

CESA-2023_7077

CVE-2023-53578

RHSA-2021:4356

RHSA-2021_4356

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:4149-1

SUSE-SU-2025:4320-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 445

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53578.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:4320-1 · Vendor Advisory
• https://git.kernel.org/stable/c/3814d211ff13ee35f2d9437439a6c7df58524137 · Patch
• https://git.kernel.org/stable/c/6417070918de3bcdbe0646e7256dae58fd8083ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53578 · Security Note
• https://git.kernel.org/stable/c/8c9ce34a6ff2c544f96ce0b088e8fd3c1b9698c4 · Patch
• https://osv.dev/vulnerability/CVE-2023-53578 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04435 · Security Note
• https://git.kernel.org/stable/c/bef57c227b52c2bde00fad33556175d36d12cfa0 · Patch
• https://git.kernel.org/stable/c/c6a796ee5a639ffb83c6e5469408cc2ec16cac6a · Patch
• https://ubuntu.com/security/CVE-2023-53578 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53578 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53578 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53578 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53578 · Vendor Advisory