Answer in brief
CVE-2023-53477 records a Medium severity (CVSS 5.5) vulnerability in ipv6: Add lwtunnel encap size of all siblings in nexthop calculation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 4.11 | Not reported |
| Linux/Linuxgeneric | >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <aba298b35619213ca787d08d472049627d8cd012 || >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <da26369377f0b671c14692e2d65ceb38131053e1 || >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <dcdddb5f490890d058ea1f194d661219e92fe88d || >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <e11e4d524eba2d3c8fdf897d7ce3853f7573bae9 || >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <aa75d826c221e8d48607aef33836cf872a159cf1 || >=beb1afac518dec5a15dc92ba8f0ca016dcf457b4 <4cc59f386991ec9374cb4bc83dbe1c0b5a95033f | aba298b35619213ca787d08d472049627d8cd012, da26369377f0b671c14692e2d65ceb38131053e1, dcdddb5f490890d058ea1f194d661219e92fe88d, e11e4d524eba2d3c8fdf897d7ce3853f7573bae9, aa75d826c221e8d48607aef33836cf872a159cf1, 4cc59f386991ec9374cb4bc83dbe1c0b5a95033f |
Published upstream
Oct 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows: WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This bug can be reproduced by script: ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100 for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100 This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size().
Quoted source text, attributed separately from HOL analysis.