Answer in brief
CVE-2023-53549 records a Medium severity (CVSS 5.5) vulnerability in netfilter: ipset: Rework long task execution when adding/deleting entries. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e62e62ea912a49f7230620f1bdc20410b943a44c <ee756980e491c829ba0495bb420b7224a9ee26b2 || >=5f7b51bf09baca8e4f80cbe879536842bafb5f31 <a1e1521b463968b4eca7163f61fb6cc54d008061 || >=5f7b51bf09baca8e4f80cbe879536842bafb5f31 <24a828f5a54bdeca0846526860d72b3766c5fe95 || >=5f7b51bf09baca8e4f80cbe879536842bafb5f31 <8964cc36ba011dc0e1041131fa2e91fb4c2a811b || >=5f7b51bf09baca8e4f80cbe879536842bafb5f31 <5e29dc36bd5e2166b834ceb19990d9e68a734d7d || e0f824abe0f412f769fb5468b36c2471430bd885 || >=5.10.157 <5.10.163 || >=5.13.14 <5.14 | ee756980e491c829ba0495bb420b7224a9ee26b2, a1e1521b463968b4eca7163f61fb6cc54d008061, 24a828f5a54bdeca0846526860d72b3766c5fe95, 8964cc36ba011dc0e1041131fa2e91fb4c2a811b, 5e29dc36bd5e2166b834ceb19990d9e68a734d7d, 5.10.163, 5.14 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Oct 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Rework long task execution when adding/deleting entries When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can result in soft lockup errors. The patch 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete") tried to fix it by limiting the max elements to process at all. However it was not enough, it is still possible that we get hung tasks. Lowering the limit is not reasonable, so the approach in this patch is as follows: rely on the method used at resizing sets and save the state when we reach a smaller internal batch limit, unlock/lock and proceed from the saved state. Thus we can avoid long continuous tasks and at the same time removed the limit to add/delete large number of elements in one step. The nfnl mutex is held during the whole operation which prevents one to issue other ipset commands in parallel.
Quoted source text, attributed separately from HOL analysis.