LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53189: ipv6/addrconf: fix a potential refcount underflow for idev

In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel IPv6 bug where a timing race can incorrectly reduce a network-device reference count. The public record does not state a business impact such as privilege escalation, remote code execution, or denial of service. Treat it as a kernel maintenance risk until your Linux vendor maps it to patched packages.

Executive priority

Handle through normal kernel patch governance unless vendor guidance raises severity for your environment. The main risk is uncertainty: the record confirms a kernel memory-management flaw but does not quantify exploitability or operational impact.

Technical view

The flaw is in ipv6/addrconf addrconf_mod_rs_timer(). A gap between checking timer_pending() and calling mod_timer() can activate rs_timer without taking an idev reference. addrconf_rs_timer() may later release a reference that was never held, causing a potential idev refcount underflow.

Likely exposure

Exposure is limited to Linux systems running affected kernel ranges or vendor kernels that include the vulnerable IPv6 addrconf code without the stable fix. Distribution backports may change version-based conclusions, so package-level vendor status matters more than upstream version alone.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of active exploitation, public exploit use, or weaponized procedures. The record describes a race and refcount underflow, but does not provide CVSS, CWE, attacker prerequisites, or confirmed impact.

Researcher notes

Focus analysis on the addrconf_mod_rs_timer() race and whether mod_timer() returning 0 is used to decide when to hold idev. The source data names affected upstream ranges and fix commits, but lacks CVSS, CWE, and exploitation details.

Mitigation direction

  • Apply Linux kernel or distribution updates that include the referenced stable fixes.
  • Check vendor advisories for your exact kernel package and support channel.
  • Prioritize internet-facing, multi-tenant, and high-availability Linux systems using IPv6.
  • Avoid assuming upstream version numbers are definitive when vendors backport patches.

Validation and detection

  • Inventory running Linux kernel packages across servers, appliances, containers hosts, and images.
  • Map each kernel to vendor guidance for CVE-2023-53189 or the stable fix commits.
  • Confirm patched systems are booted into the updated kernel, not only installed.
  • Review whether IPv6 addrconf is enabled on exposed or critical hosts.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53189 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, b7b1bfce0bb68bd8f6e62a28295922785cc63781, 973d5956f754cfc306f5e274d71503498f4b0324unaffected
LinuxLinux3.11, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.