{"api_version":"1","generated_at":"2026-10-15T23:43:48+00:00","cve":"CVE-2023-54193","urls":{"html":"https://cve.report/CVE-2023-54193","api":"https://cve.report/api/cve/CVE-2023-54193.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-54193","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54193"},"summary":{"title":"net/sched: cls_api: remove block_cb from driver_list before freeing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: remove block_cb from driver_list before freeing\n\nError handler of tcf_block_bind() frees the whole bo->cb_list on error.\nHowever, by that time the flow_block_cb instances are already in the driver\nlist because driver ndo_setup_tc() callback is called before that up the\ncall chain in tcf_block_offload_cmd(). This leaves dangling pointers to\nfreed objects in the list and causes use-after-free[0]. Fix it by also\nremoving flow_block_cb instances from driver_list before deallocating them.\n\n[0]:\n[  279.868433] ==================================================================\n[  279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0\n[  279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963\n\n[  279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4\n[  279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  279.876295] Call Trace:\n[  279.876882]  <TASK>\n[  279.877413]  dump_stack_lvl+0x33/0x50\n[  279.878198]  print_report+0xc2/0x610\n[  279.878987]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.879994]  kasan_report+0xae/0xe0\n[  279.880750]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.881744]  ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]\n[  279.883047]  flow_block_cb_setup_simple+0x631/0x7c0\n[  279.884027]  tcf_block_offload_cmd.isra.0+0x189/0x2d0\n[  279.885037]  ? tcf_block_setup+0x6b0/0x6b0\n[  279.885901]  ? mutex_lock+0x7d/0xd0\n[  279.886669]  ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0\n[  279.887844]  ? ingress_init+0x1c0/0x1c0 [sch_ingress]\n[  279.888846]  tcf_block_get_ext+0x61c/0x1200\n[  279.889711]  ingress_init+0x112/0x1c0 [sch_ingress]\n[  279.890682]  ? clsact_init+0x2b0/0x2b0 [sch_ingress]\n[  279.891701]  qdisc_create+0x401/0xea0\n[  279.892485]  ? qdisc_tree_reduce_backlog+0x470/0x470\n[  279.893473]  tc_modify_qdisc+0x6f7/0x16d0\n[  279.894344]  ? tc_get_qdisc+0xac0/0xac0\n[  279.895213]  ? mutex_lock+0x7d/0xd0\n[  279.896005]  ? __mutex_lock_slowpath+0x10/0x10\n[  279.896910]  rtnetlink_rcv_msg+0x5fe/0x9d0\n[  279.897770]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.898672]  ? __sys_sendmsg+0xb5/0x140\n[  279.899494]  ? do_syscall_64+0x3d/0x90\n[  279.900302]  ? entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[  279.901337]  ? kasan_save_stack+0x2e/0x40\n[  279.902177]  ? kasan_save_stack+0x1e/0x40\n[  279.903058]  ? kasan_set_track+0x21/0x30\n[  279.903913]  ? kasan_save_free_info+0x2a/0x40\n[  279.904836]  ? ____kasan_slab_free+0x11a/0x1b0\n[  279.905741]  ? kmem_cache_free+0x179/0x400\n[  279.906599]  netlink_rcv_skb+0x12c/0x360\n[  279.907450]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.908360]  ? netlink_ack+0x1550/0x1550\n[  279.909192]  ? rhashtable_walk_peek+0x170/0x170\n[  279.910135]  ? kmem_cache_alloc_node+0x1af/0x390\n[  279.911086]  ? _copy_from_iter+0x3d6/0xc70\n[  279.912031]  netlink_unicast+0x553/0x790\n[  279.912864]  ? netlink_attachskb+0x6a0/0x6a0\n[  279.913763]  ? netlink_recvmsg+0x416/0xb50\n[  279.914627]  netlink_sendmsg+0x7a1/0xcb0\n[  279.915473]  ? netlink_unicast+0x790/0x790\n[  279.916334]  ? iovec_from_user.part.0+0x4d/0x220\n[  279.917293]  ? netlink_unicast+0x790/0x790\n[  279.918159]  sock_sendmsg+0xc5/0x190\n[  279.918938]  ____sys_sendmsg+0x535/0x6b0\n[  279.919813]  ? import_iovec+0x7/0x10\n[  279.920601]  ? kernel_sendmsg+0x30/0x30\n[  279.921423]  ? __copy_msghdr+0x3c0/0x3c0\n[  279.922254]  ? import_iovec+0x7/0x10\n[  279.923041]  ___sys_sendmsg+0xeb/0x170\n[  279.923854]  ? copy_msghdr_from_user+0x110/0x110\n[  279.924797]  ? ___sys_recvmsg+0xd9/0x130\n[  279.925630]  ? __perf_event_task_sched_in+0x183/0x470\n[  279.926656]  ? ___sys_sendmsg+0x170/0x170\n[  279.927529]  ? ctx_sched_in+0x530/0x530\n[  279.928369]  ? update_curr+0x283/0x4f0\n[  279.929185]  ? perf_event_update_userpage+0x570/0x570\n[  279.930201]  ? __fget_light+0x57/0x520\n[  279.931023]  ? __switch_to+0x53d/0xe70\n[  27\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-30 13:16:07","updated_at":"2026-10-15 22:17:54"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/da94a7781fc3c92e7df7832bc2746f4d39bc624e","name":"https://git.kernel.org/stable/c/da94a7781fc3c92e7df7832bc2746f4d39bc624e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7311c8be3755611bf6edea4dfbeb190b4bdd489f","name":"https://git.kernel.org/stable/c/7311c8be3755611bf6edea4dfbeb190b4bdd489f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/55866fe3fded3ce94ac3fc1bb3dfce654282f483","name":"https://git.kernel.org/stable/c/55866fe3fded3ce94ac3fc1bb3dfce654282f483","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/26aec72429a05e917d574eca0efc5306c63a8862","name":"https://git.kernel.org/stable/c/26aec72429a05e917d574eca0efc5306c63a8862","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7b7a74ed303d532fb73ae4b1697f16a0fea89cd0","name":"https://git.kernel.org/stable/c/7b7a74ed303d532fb73ae4b1697f16a0fea89cd0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cc5fe387c6294d0471cb7ed064efac97fac65ccc","name":"https://git.kernel.org/stable/c/cc5fe387c6294d0471cb7ed064efac97fac65ccc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cb145932fcf6814e7e95e467eb70e7849a845ae9","name":"https://git.kernel.org/stable/c/cb145932fcf6814e7e95e467eb70e7849a845ae9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54193","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54193","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 cc5fe387c6294d0471cb7ed064efac97fac65ccc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 7311c8be3755611bf6edea4dfbeb190b4bdd489f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 cb145932fcf6814e7e95e467eb70e7849a845ae9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 55866fe3fded3ce94ac3fc1bb3dfce654282f483 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 26aec72429a05e917d574eca0efc5306c63a8862 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 7b7a74ed303d532fb73ae4b1697f16a0fea89cd0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 da94a7781fc3c92e7df7832bc2746f4d39bc624e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.243 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.180 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.112 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.29 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.16 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3.3 6.3.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"54193","cve":"CVE-2023-54193","epss":"0.001400000","percentile":"0.037970000","score_date":"2026-08-06","updated_at":"2026-08-07 00:14:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-54193","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T21:38:55.488795Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T21:41:40.994Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cc5fe387c6294d0471cb7ed064efac97fac65ccc","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"7311c8be3755611bf6edea4dfbeb190b4bdd489f","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"cb145932fcf6814e7e95e467eb70e7849a845ae9","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"55866fe3fded3ce94ac3fc1bb3dfce654282f483","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"26aec72429a05e917d574eca0efc5306c63a8862","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"7b7a74ed303d532fb73ae4b1697f16a0fea89cd0","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"},{"lessThan":"da94a7781fc3c92e7df7832bc2746f4d39bc624e","status":"affected","version":"59094b1e5094c7e50a3d2912202fd30b6a1dadf8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.243","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.180","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.112","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.29","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.16","versionType":"semver"},{"lessThanOrEqual":"6.3.*","status":"unaffected","version":"6.3.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.243","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.180","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.112","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.29","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.16","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.3","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4","versionStartIncluding":"5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: remove block_cb from driver_list before freeing\n\nError handler of tcf_block_bind() frees the whole bo->cb_list on error.\nHowever, by that time the flow_block_cb instances are already in the driver\nlist because driver ndo_setup_tc() callback is called before that up the\ncall chain in tcf_block_offload_cmd(). This leaves dangling pointers to\nfreed objects in the list and causes use-after-free[0]. Fix it by also\nremoving flow_block_cb instances from driver_list before deallocating them.\n\n[0]:\n[  279.868433] ==================================================================\n[  279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0\n[  279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963\n\n[  279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4\n[  279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  279.876295] Call Trace:\n[  279.876882]  <TASK>\n[  279.877413]  dump_stack_lvl+0x33/0x50\n[  279.878198]  print_report+0xc2/0x610\n[  279.878987]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.879994]  kasan_report+0xae/0xe0\n[  279.880750]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.881744]  ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]\n[  279.883047]  flow_block_cb_setup_simple+0x631/0x7c0\n[  279.884027]  tcf_block_offload_cmd.isra.0+0x189/0x2d0\n[  279.885037]  ? tcf_block_setup+0x6b0/0x6b0\n[  279.885901]  ? mutex_lock+0x7d/0xd0\n[  279.886669]  ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0\n[  279.887844]  ? ingress_init+0x1c0/0x1c0 [sch_ingress]\n[  279.888846]  tcf_block_get_ext+0x61c/0x1200\n[  279.889711]  ingress_init+0x112/0x1c0 [sch_ingress]\n[  279.890682]  ? clsact_init+0x2b0/0x2b0 [sch_ingress]\n[  279.891701]  qdisc_create+0x401/0xea0\n[  279.892485]  ? qdisc_tree_reduce_backlog+0x470/0x470\n[  279.893473]  tc_modify_qdisc+0x6f7/0x16d0\n[  279.894344]  ? tc_get_qdisc+0xac0/0xac0\n[  279.895213]  ? mutex_lock+0x7d/0xd0\n[  279.896005]  ? __mutex_lock_slowpath+0x10/0x10\n[  279.896910]  rtnetlink_rcv_msg+0x5fe/0x9d0\n[  279.897770]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.898672]  ? __sys_sendmsg+0xb5/0x140\n[  279.899494]  ? do_syscall_64+0x3d/0x90\n[  279.900302]  ? entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[  279.901337]  ? kasan_save_stack+0x2e/0x40\n[  279.902177]  ? kasan_save_stack+0x1e/0x40\n[  279.903058]  ? kasan_set_track+0x21/0x30\n[  279.903913]  ? kasan_save_free_info+0x2a/0x40\n[  279.904836]  ? ____kasan_slab_free+0x11a/0x1b0\n[  279.905741]  ? kmem_cache_free+0x179/0x400\n[  279.906599]  netlink_rcv_skb+0x12c/0x360\n[  279.907450]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.908360]  ? netlink_ack+0x1550/0x1550\n[  279.909192]  ? rhashtable_walk_peek+0x170/0x170\n[  279.910135]  ? kmem_cache_alloc_node+0x1af/0x390\n[  279.911086]  ? _copy_from_iter+0x3d6/0xc70\n[  279.912031]  netlink_unicast+0x553/0x790\n[  279.912864]  ? netlink_attachskb+0x6a0/0x6a0\n[  279.913763]  ? netlink_recvmsg+0x416/0xb50\n[  279.914627]  netlink_sendmsg+0x7a1/0xcb0\n[  279.915473]  ? netlink_unicast+0x790/0x790\n[  279.916334]  ? iovec_from_user.part.0+0x4d/0x220\n[  279.917293]  ? netlink_unicast+0x790/0x790\n[  279.918159]  sock_sendmsg+0xc5/0x190\n[  279.918938]  ____sys_sendmsg+0x535/0x6b0\n[  279.919813]  ? import_iovec+0x7/0x10\n[  279.920601]  ? kernel_sendmsg+0x30/0x30\n[  279.921423]  ? __copy_msghdr+0x3c0/0x3c0\n[  279.922254]  ? import_iovec+0x7/0x10\n[  279.923041]  ___sys_sendmsg+0xeb/0x170\n[  279.923854]  ? copy_msghdr_from_user+0x110/0x110\n[  279.924797]  ? ___sys_recvmsg+0xd9/0x130\n[  279.925630]  ? __perf_event_task_sched_in+0x183/0x470\n[  279.926656]  ? ___sys_sendmsg+0x170/0x170\n[  279.927529]  ? ctx_sched_in+0x530/0x530\n[  279.928369]  ? update_curr+0x283/0x4f0\n[  279.929185]  ? perf_event_update_userpage+0x570/0x570\n[  279.930201]  ? __fget_light+0x57/0x520\n[  279.931023]  ? __switch_to+0x53d/0xe70\n[  27\n---truncated---"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through the tc/rtnetlink qdisc-configuration path (RTM_NEWQDISC via netlink sendmsg), which requires local system access, not a network peer.\nAC:L - The attacker controls every tc operation needed to set up the failing reoffload and trigger the error path, and there is no uncontrolled race; on a common offload-capable NIC the sequence is reliably reproducible.\nPR:L - Configuring tc qdiscs/blocks requires CAP_NET_ADMIN, which an unprivileged local user can obtain in a new network namespace via unshare -Urn, so only low privilege is needed.\nUI:N - The entire sequence is driven by the attacker's own netlink/tc operations with no victim interaction required.\nS:U - The use-after-free corrupts kernel data within the same kernel security authority; no crossing of a VM/IOMMU/sandbox boundary occurs.\nC:H - The dangling driver_list pointer references a freed kmalloc-192 object whose contents can be attacker-controlled via heap spraying, enabling disclosure of kernel memory.\nI:H - A use-after-free of a reclaimable heap object provides a write/type-confusion primitive that can be leveraged toward arbitrary memory modification and control-flow hijacking.\nA:H - The use-after-free reliably causes kernel oops/panic (as shown by the KASAN report), resulting in denial of service."}]}],"providerMetadata":{"dateUpdated":"2026-08-05T09:17:56.124Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/cc5fe387c6294d0471cb7ed064efac97fac65ccc"},{"url":"https://git.kernel.org/stable/c/7311c8be3755611bf6edea4dfbeb190b4bdd489f"},{"url":"https://git.kernel.org/stable/c/cb145932fcf6814e7e95e467eb70e7849a845ae9"},{"url":"https://git.kernel.org/stable/c/55866fe3fded3ce94ac3fc1bb3dfce654282f483"},{"url":"https://git.kernel.org/stable/c/26aec72429a05e917d574eca0efc5306c63a8862"},{"url":"https://git.kernel.org/stable/c/7b7a74ed303d532fb73ae4b1697f16a0fea89cd0"},{"url":"https://git.kernel.org/stable/c/da94a7781fc3c92e7df7832bc2746f4d39bc624e"}],"title":"net/sched: cls_api: remove block_cb from driver_list before freeing","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-54193","datePublished":"2025-12-30T12:09:00.738Z","dateReserved":"2025-12-30T12:06:44.498Z","dateUpdated":"2026-10-15T21:41:40.994Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-30 13:16:07","lastModifiedDate":"2026-10-15 22:17:54","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T21:38:55.488795Z","id":"CVE-2023-54193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"54193","Ordinal":"1","Title":"net/sched: cls_api: remove block_cb from driver_list before free","CVE":"CVE-2023-54193","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"54193","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: remove block_cb from driver_list before freeing\n\nError handler of tcf_block_bind() frees the whole bo->cb_list on error.\nHowever, by that time the flow_block_cb instances are already in the driver\nlist because driver ndo_setup_tc() callback is called before that up the\ncall chain in tcf_block_offload_cmd(). This leaves dangling pointers to\nfreed objects in the list and causes use-after-free[0]. Fix it by also\nremoving flow_block_cb instances from driver_list before deallocating them.\n\n[0]:\n[  279.868433] ==================================================================\n[  279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0\n[  279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963\n\n[  279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4\n[  279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  279.876295] Call Trace:\n[  279.876882]  <TASK>\n[  279.877413]  dump_stack_lvl+0x33/0x50\n[  279.878198]  print_report+0xc2/0x610\n[  279.878987]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.879994]  kasan_report+0xae/0xe0\n[  279.880750]  ? flow_block_cb_setup_simple+0x631/0x7c0\n[  279.881744]  ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]\n[  279.883047]  flow_block_cb_setup_simple+0x631/0x7c0\n[  279.884027]  tcf_block_offload_cmd.isra.0+0x189/0x2d0\n[  279.885037]  ? tcf_block_setup+0x6b0/0x6b0\n[  279.885901]  ? mutex_lock+0x7d/0xd0\n[  279.886669]  ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0\n[  279.887844]  ? ingress_init+0x1c0/0x1c0 [sch_ingress]\n[  279.888846]  tcf_block_get_ext+0x61c/0x1200\n[  279.889711]  ingress_init+0x112/0x1c0 [sch_ingress]\n[  279.890682]  ? clsact_init+0x2b0/0x2b0 [sch_ingress]\n[  279.891701]  qdisc_create+0x401/0xea0\n[  279.892485]  ? qdisc_tree_reduce_backlog+0x470/0x470\n[  279.893473]  tc_modify_qdisc+0x6f7/0x16d0\n[  279.894344]  ? tc_get_qdisc+0xac0/0xac0\n[  279.895213]  ? mutex_lock+0x7d/0xd0\n[  279.896005]  ? __mutex_lock_slowpath+0x10/0x10\n[  279.896910]  rtnetlink_rcv_msg+0x5fe/0x9d0\n[  279.897770]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.898672]  ? __sys_sendmsg+0xb5/0x140\n[  279.899494]  ? do_syscall_64+0x3d/0x90\n[  279.900302]  ? entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[  279.901337]  ? kasan_save_stack+0x2e/0x40\n[  279.902177]  ? kasan_save_stack+0x1e/0x40\n[  279.903058]  ? kasan_set_track+0x21/0x30\n[  279.903913]  ? kasan_save_free_info+0x2a/0x40\n[  279.904836]  ? ____kasan_slab_free+0x11a/0x1b0\n[  279.905741]  ? kmem_cache_free+0x179/0x400\n[  279.906599]  netlink_rcv_skb+0x12c/0x360\n[  279.907450]  ? rtnl_calcit.isra.0+0x2b0/0x2b0\n[  279.908360]  ? netlink_ack+0x1550/0x1550\n[  279.909192]  ? rhashtable_walk_peek+0x170/0x170\n[  279.910135]  ? kmem_cache_alloc_node+0x1af/0x390\n[  279.911086]  ? _copy_from_iter+0x3d6/0xc70\n[  279.912031]  netlink_unicast+0x553/0x790\n[  279.912864]  ? netlink_attachskb+0x6a0/0x6a0\n[  279.913763]  ? netlink_recvmsg+0x416/0xb50\n[  279.914627]  netlink_sendmsg+0x7a1/0xcb0\n[  279.915473]  ? netlink_unicast+0x790/0x790\n[  279.916334]  ? iovec_from_user.part.0+0x4d/0x220\n[  279.917293]  ? netlink_unicast+0x790/0x790\n[  279.918159]  sock_sendmsg+0xc5/0x190\n[  279.918938]  ____sys_sendmsg+0x535/0x6b0\n[  279.919813]  ? import_iovec+0x7/0x10\n[  279.920601]  ? kernel_sendmsg+0x30/0x30\n[  279.921423]  ? __copy_msghdr+0x3c0/0x3c0\n[  279.922254]  ? import_iovec+0x7/0x10\n[  279.923041]  ___sys_sendmsg+0xeb/0x170\n[  279.923854]  ? copy_msghdr_from_user+0x110/0x110\n[  279.924797]  ? ___sys_recvmsg+0xd9/0x130\n[  279.925630]  ? __perf_event_task_sched_in+0x183/0x470\n[  279.926656]  ? ___sys_sendmsg+0x170/0x170\n[  279.927529]  ? ctx_sched_in+0x530/0x530\n[  279.928369]  ? update_curr+0x283/0x4f0\n[  279.929185]  ? perf_event_update_userpage+0x570/0x570\n[  279.930201]  ? __fget_light+0x57/0x520\n[  279.931023]  ? __switch_to+0x53d/0xe70\n[  27\n---truncated---","Type":"Description","Title":"net/sched: cls_api: remove block_cb from driver_list before free"}]}}}