LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53669: tcp: fix skb_copy_ubufs() vs BIG TCP

In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53669 is a Linux kernel networking crash bug tied to large TCP packets. The sources describe crashes when TCP transmit zero-copy, hugepages, and BIG TCP allow socket buffers larger than older assumptions supported. Business impact is most likely service disruption on affected Linux systems, but severity and exploitability are not scored in the provided sources.

Executive priority

Track and patch through normal kernel maintenance, with faster action for internet-facing or high-throughput Linux systems where kernel crashes affect customer availability. Current evidence does not justify emergency response by itself because severity, CVSS, and exploitation evidence are absent from the provided sources.

Technical view

The bug is in skb_copy_ubufs(). It assumed payload copying could fit within MAX_SKB_FRAGS order-0 pages. BIG TCP can place up to 512 KB in one skb, breaking that assumption when skb length exceeds about 68 KB. The resolved fix uses higher-order pages when needed, with __GFP_COMP to avoid memory leakage.

Likely exposure

Exposure appears limited to affected Linux kernels using networking paths involving BIG TCP, TCP transmit zero-copy, hugepages, and large skbs. The bundle lists Linux 5.19, 6.1.29, 6.2.16, 6.3.3, and 6.4 as affected, but distribution backport status is not provided.

Exploitation context

The source bundle reports crashes but does not provide CVSS, CWE, public exploitation evidence, or KEV listing. There is no evidence here of active exploitation. Treat this as a kernel reliability and availability risk until vendor advisories clarify severity for your deployed kernels.

Researcher notes

Key research gaps are exploitability, privilege requirements, remote reachability, and distribution-specific affected ranges. The source points to a boundary failure between skb_copy_ubufs assumptions and BIG TCP skb sizing. Avoid over-scoping: the bundle does not prove all Linux systems or all TCP workloads are meaningfully exposed.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced upstream stable fixes.
  • Check Linux distribution advisories for backported fixes and affected package versions.
  • Prioritize systems using BIG TCP, TCP zero-copy, hugepages, or high-throughput networking.
  • Review kernel configuration and network limits with vendor guidance before treating them as mitigations.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, containers hosts, and network nodes.
  • Check vendor changelogs for the referenced upstream stable commit fixes.
  • Identify hosts using BIG TCP, transmit zero-copy, hugepages, or unusually large GSO sizes.
  • Review crash logs for skb_copy_ubufs-related kernel failures.
  • Confirm CVE-2023-53669 is not listed as KEV in the provided bundle.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53669 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7c4e983c4f3cf94fcd879730c6caa877e0768a4d, 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, 7c4e983c4f3cf94fcd879730c6caa877e0768a4d, 7c4e983c4f3cf94fcd879730c6caa877e0768a4dunaffected
LinuxLinux5.19, 0, 6.1.29, 6.2.16, 6.3.3, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.