PT-2025-43127 · Linux+2 · Linux Kernel+2
Published
2023-09-07
·
Updated
2025-12-04
·
CVE-2023-53726
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.4.0-rc4-syzkaller-g908f31f2a05b
Description
The Linux kernel contains a flaw in the arm64 checksum implementation. Specifically, a negative length provided to the checksum calculation can lead to an out-of-bounds read in the
do csum function. This issue was discovered through fuzzing with syzkaller, which identified a scenario where a negative length triggers an undefined shift and an out-of-bounds read in the kernel's slab allocator. The fix extends the existing early return for zero-length inputs to also reject negative lengths, aligning the implementation with the generic code in lib/checksum.c. The vulnerable code is located in arch/arm64/lib/csum.c.Recommendations
Update to a version of the Linux kernel that includes the fix, specifically version 6.4.0-rc4-syzkaller-g908f31f2a05b or later.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Red Hat
Suse