LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53660: bpf, cpumap: Handle skb as well when clean up ptr_ring

In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]------------ Incorrect XDP memory type (-2128176192) usage WARNING: CPU: 7 PID: 1442 at net/core/xdp.c:405 Modules linked in: CPU: 7 PID: 1442 Comm: kworker/7:0 Tainted: G 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events __cpu_map_entry_free RIP: 0010:__xdp_return+0x1e4/0x4a0 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ? __xdp_return+0x1e4/0x4a0 ...... xdp_return_frame+0x4d/0x150 __cpu_map_entry_free+0xf9/0x230 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> The reason for the warning is twofold. One is due to the kthread cpu_map_kthread_run() is stopped prematurely. Another one is __cpu_map_ring_cleanup() doesn't handle skb mode and treats skbs in ptr_ring as XDP frames. Prematurely-stopped kthread will be fixed by the preceding patch and ptr_ring will be empty when __cpu_map_ring_cleanup() is called. But as the comments in __cpu_map_ring_cleanup() said, handling and freeing skbs in ptr_ring as well to "catch any broken behaviour gracefully".

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53660 is a Linux kernel bug in BPF/XDP CPU map cleanup. Under specific XDP redirect conditions, cleanup can mishandle socket buffers as XDP frames, triggering a kernel warning. The supplied sources do not provide CVSS, impact severity, or evidence of active exploitation.

Executive priority

Treat this as a patch-management item, not an emergency based on current evidence. Increase priority for Linux networking infrastructure using eBPF/XDP, because the bug sits in kernel packet-processing cleanup code.

Technical view

The flaw is in cpumap ptr_ring cleanup. When xdp_redirect_cpu runs with skb-mode and stress-mode, __cpu_map_ring_cleanup() may treat skbs as XDP frames during cleanup, producing incorrect XDP memory type warnings. Kernel stable commits resolve this by handling and freeing skbs gracefully.

Likely exposure

Exposure is most likely on Linux systems running affected kernel branches and using BPF/XDP cpumap or xdp_redirect_cpu paths. General Linux systems may still carry the code, but the source bundle only demonstrates the issue under specific skb-mode and stress-mode conditions.

Exploitation context

No KEV listing is present, and the provided sources do not report active exploitation or public weaponization. The evidence describes a kernel warning observed during testing, not an externally proven exploitation path.

Researcher notes

The source bundle lacks CVSS, CWE, crash impact details, and exploitability analysis. The affected-version data is sparse, so validate against distribution advisories and the four kernel stable commit references before scoping production exposure.

Mitigation direction

  • Apply vendor-supported Linux kernel updates containing the referenced stable fixes.
  • Prioritize systems using eBPF, XDP, cpumap, or high-performance packet processing.
  • If patching is delayed, check vendor guidance for supported temporary mitigations.
  • Track distribution advisories for exact fixed package versions.

Validation and detection

  • Inventory running Linux kernel versions across exposed and packet-processing systems.
  • Check vendor changelogs or source trees for the referenced stable commits.
  • Review whether workloads use XDP redirect CPU map functionality.
  • Confirm no reliance on direct wrangler or unsupported deployment paths is involved.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53660 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux11941f8a85362f612df61f4aaab0e41b64d2111d, 11941f8a85362f612df61f4aaab0e41b64d2111d, 11941f8a85362f612df61f4aaab0e41b64d2111d, 11941f8a85362f612df61f4aaab0e41b64d2111dunaffected
LinuxLinux5.15, 0, 5.15.126, 6.1.45, 6.4.10, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.