CVE-2023-53669: tcp: fix skb_copy_ubufs() vs BIG TCP

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-07 · updated 2026-10-15
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.

Affected products

Linux kernel: from 5.19 before 6.1.29; from 6.2 before 6.2.16; from 6.3 before 6.3.3 — fixed in 6.1.29, 6.2.16, 6.3.3

How to fix

Upgrade to a fixed version: Linux kernel 6.1.29, 6.2.16, 6.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53669 or the next vulnerability affects your stack