Look up another CVE · open CVE-2023-53781 in the interactive tracker

CVE-2023-53781

smc: Fix use-after-free in tcp_write_timer_handler().

7.8 EPSS 0.1% AV:L

Published 2025-12-09 (10 months ago) by the Linux kernel CNA. Subsystem net/smc. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2023-53781 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	fixed	6.3.7-1	Update the kernel and reboot. Fixed in 6.3.7-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	6.3.7-1	Update the kernel and reboot. Fixed in 6.3.7-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	6.3.7-1	Update the kernel and reboot. Fixed in 6.3.7-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket. However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers. The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket(). [0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) ================================================================== BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) </IRQ>

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/smc/af_smc.c

What this is: SHARED MEMORY COMMUNICATIONS (SMC) SOCKETSMAINTAINERS section matched on net/smc/ · linux-rdma@vger.kernel.org · Supported
Kernel module: smc

Check it on the machine

grep -w CONFIG_SMC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w smc

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.

bookworm, trixiem
forky, sidn

m: a loadable module on every flavour - check lsmod, can be blacklisted
n: not enabled on any flavour - this release does not build the code

Build switch: CONFIG_SMC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2025-12-09 (10 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.14%, higher than 3.3% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/smc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.11	6.2.12	1cc41c8acfc1
4.11	6.3	9744d2bf1976

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The UAF is triggered by a locally-armed TCP timer; the attacker reaches it entirely through local syscalls (creating an AF_SMC socket, connecting it, closing it) plus network-namespace teardown. No received network packet triggers the vulnerable code path, so this is a local attack surface.
AC:LAttack complexity, low: The attacker controls both sides: they arm the clcsock's TCP timers (e.g. connecting to an unresponsive peer so it stays non-TCP_CLOSE) and control when the net namespace is destroyed, and can spray many socket/namespace pairs to reliably land the timer firing on freed memory.
PR:LPrivileges required, low: Triggering requires a destroyable network namespace (the init netns is never freed), which an unprivileged local user obtains via user namespaces (unshare -Urn); AF_SMC socket creation itself is not capability-gated.
UI:NUser interaction, none: The attacker performs all setup (socket creation, connect, close, namespace teardown) themselves; no victim action is required.
S:UScope, unchanged: The use-after-free corrupts a freed struct net within the kernel's own security authority; it does not cross a VM, IOMMU, or sandbox boundary.
C:HConfidentiality impact, high: This is a slab use-after-free of struct net whose freed memory can be reclaimed with attacker-influenced data before the timer reads sysctl fields from it, enabling information disclosure per UAF guidance.
I:HIntegrity impact, high: The timer handlers write into the freed net object (MIB counter increments via __NET_INC_STATS), and reclaiming the freed slab enables heap-spray/write primitives, so integrity impact is High per UAF guidance.
A:HAvailability impact, high: A use-after-free of the network namespace reliably causes kernel oops/panic (as reported by KASAN/syzbot), giving High availability impact.