PT-2025-41111 · Linux+1 · Linux Kernel+1

Published 2025-10-07 · Updated 2025-12-04 · CVE-2023-53667

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.106-syzkaller-00249-g19c0ed55a470

Description The Linux kernel contains a flaw within the cdc ncm module related to handling excessively small values of dwNtbOutMaxSize. Specifically, the cdc ncm check tx max() function does not adequately validate this value, potentially leading to insufficient memory allocation when creating SKB (Socket Kernel Buffer) structures. This can result in a kernel panic due to SKB bounds checking failures if the size of SKB header structs increases, exceeding the allocated data space. The issue arises from the alignment of memory during SKB allocation and the limited space available for CDC data.

Recommendations Update the Linux kernel to version 5.15.106-syzkaller-00249-g19c0ed55a470 or a later version that includes the fix.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2023-53667

SUSE-SU-2025:4111-1

SUSE-SU-2025:4139-1

SUSE-SU-2025:4149-1

SUSE-SU-2025:4189-1

SUSE-SU-2025:4320-1

Affected Products

Linux Kernel

Suse

References · 613

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53667.json · Exploit
• https://git.kernel.org/stable/c/ff484163dfb61b58f23e4dbd007de1094427669c · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53667 · Security Note
• https://git.kernel.org/stable/c/7e01c7f7046efc2c7c192c3619db43292b98e997 · Patch
• https://cve.org/CVERecord?id=CVE-2023-53667 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4111-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2334ff0b343ba6ba7a6c0586fcc83992bbbc1776 · Patch
• https://git.kernel.org/stable/c/9be921854e983a81a0aeeae5febcd87093086e46 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53667 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53667 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4189-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4320-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53667 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4149-1 · Vendor Advisory