Answer in brief
CVE-2023-53338 records a Critical severity (CVSS 9.8) vulnerability in lwt: Fix return values of BPF xmit ops. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <67f8f2bae8e7ac72e09def2b667e44704c4d1ee1 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <a97f221651fcdc891166e9bc270e3d9bfa5a0080 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <e3f647e4b642f9f6d32795a16f92c116c138d2af || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <065d5f17096ec9161180e2c890afdff4dc6125f2 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <d68c17402442f5f494a2c3ebde5cb82f6aa9160a || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <65583f9e070db7bece20710cfa2e3daeb0b831d9 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <29b22badb7a84b783e3a4fffca16f7768fb31205 | 67f8f2bae8e7ac72e09def2b667e44704c4d1ee1, a97f221651fcdc891166e9bc270e3d9bfa5a0080, e3f647e4b642f9f6d32795a16f92c116c138d2af, 065d5f17096ec9161180e2c890afdff4dc6125f2, d68c17402442f5f494a2c3ebde5cb82f6aa9160a, 65583f9e070db7bece20710cfa2e3daeb0b831d9, 29b22badb7a84b783e3a4fffca16f7768fb31205 |
| Linux/Linuxgeneric | 4.10 | Not reported |
Published upstream
Sep 17, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2023-53338 records a Critical severity (CVSS 9.8) vulnerability in lwt: Fix return values of BPF xmit ops. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <67f8f2bae8e7ac72e09def2b667e44704c4d1ee1 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <a97f221651fcdc891166e9bc270e3d9bfa5a0080 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <e3f647e4b642f9f6d32795a16f92c116c138d2af || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <065d5f17096ec9161180e2c890afdff4dc6125f2 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <d68c17402442f5f494a2c3ebde5cb82f6aa9160a || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <65583f9e070db7bece20710cfa2e3daeb0b831d9 || >=3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 <29b22badb7a84b783e3a4fffca16f7768fb31205 | 67f8f2bae8e7ac72e09def2b667e44704c4d1ee1, a97f221651fcdc891166e9bc270e3d9bfa5a0080, e3f647e4b642f9f6d32795a16f92c116c138d2af, 065d5f17096ec9161180e2c890afdff4dc6125f2, d68c17402442f5f494a2c3ebde5cb82f6aa9160a, 65583f9e070db7bece20710cfa2e3daeb0b831d9, 29b22badb7a84b783e3a4fffca16f7768fb31205 |
| Linux/Linuxgeneric | 4.10 | Not reported |
Published upstream
Sep 17, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.
Quoted source text, attributed separately from HOL analysis.