LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54155: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()

In the Linux kernel, the following vulnerability has been resolved: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 ____bpf_xdp_adjust_tail net/core/filter.c:4121 [inline] WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 bpf_xdp_adjust_tail+0x466/0xa10 net/core/filter.c:4103 ... Call Trace: <TASK> bpf_prog_4add87e5301a4105+0x1a/0x1c __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run_xdp include/linux/filter.h:775 [inline] bpf_prog_run_generic_xdp+0x57e/0x11e0 net/core/dev.c:4721 netif_receive_generic_xdp net/core/dev.c:4807 [inline] do_xdp_generic+0x35c/0x770 net/core/dev.c:4866 tun_get_user+0x2340/0x3ca0 drivers/net/tun.c:1919 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd xdp->frame_sz > PAGE_SIZE check was introduced in commit c8741e2bfe87 ("xdp: Allow bpf_xdp_adjust_tail() to grow packet size"). But Jesper Dangaard Brouer <jbrouer@redhat.com> noted that after introducing the xdp_init_buff() which all XDP driver use - it's safe to remove this check. The original intend was to catch cases where XDP drivers have not been updated to use xdp.frame_sz, but that is not longer a concern (since xdp_init_buff). Running the initial syzkaller repro it was discovered that the contiguous physical memory allocation is used for both xdp paths in tun_get_user(), e.g. tun_build_skb() and tun_alloc_skb(). It was also stated by Jesper Dangaard Brouer <jbrouer@redhat.com> that XDP can work on higher order pages, as long as this is contiguous physical memory (e.g. a page).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel XDP/eBPF bug found by syzkaller. The issue triggered a kernel warning when packet-tail adjustment met a larger XDP frame size. The source describes a code correction, not confirmed real-world compromise. Business urgency depends on whether exposed systems run affected Linux kernel branches with XDP, eBPF, or TUN/TAP use.

Executive priority

Schedule remediation through normal kernel patch governance, escalating for internet-facing or high-density container hosts using advanced packet processing. Current sources do not prove active exploitation or critical severity, but kernel networking bugs can have broad operational reach.

Technical view

The vulnerable logic is in bpf_xdp_adjust_tail() in net/core/filter.c. A PAGE_SIZE frame_sz check became obsolete after xdp_init_buff() adoption across XDP drivers. Syzkaller reached the warning through generic XDP and tun_get_user(). Stable commits remove the unnecessary check because contiguous higher-order pages are valid for XDP.

Likely exposure

Exposure is limited to Linux systems on affected kernel versions where XDP/eBPF packet processing paths are reachable. The bundle names Linux kernel entries including 5.12, 5.15.127, 6.1.46, 6.4.11, and 6.5, but exact branch range details should be validated against vendor kernel advisories.

Exploitation context

The provided evidence shows a syzkaller report and kernel fix. It does not cite active exploitation, public exploit availability, CVSS scoring, CWE classification, or inclusion in CISA KEV. Treat exploitation status as unconfirmed rather than active.

Researcher notes

This appears to be a correctness fix for an obsolete guard in XDP frame sizing. The record lacks CVSS, CWE, impact detail, and exploitability analysis. Researchers should focus on branch-specific affected ranges, backport status, and whether local privileges or specific network device paths are required.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable commits.
  • Check distribution vendor advisories for backported kernel fixes.
  • Prioritize systems using XDP, eBPF networking, TUN/TAP, or container networking features.
  • If patch timing is unclear, consult vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and container hosts.
  • Map systems using XDP, eBPF networking, TUN/TAP, or high-performance packet paths.
  • Confirm whether vendor kernel packages include the referenced stable fixes.
  • Review kernel logs for related warnings, while avoiding assumptions of compromise.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54155 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux43b5169d8355ccf26d726fbc75f083b2429113e4, 43b5169d8355ccf26d726fbc75f083b2429113e4, 43b5169d8355ccf26d726fbc75f083b2429113e4, 43b5169d8355ccf26d726fbc75f083b2429113e4unaffected
LinuxLinux5.12, 0, 5.15.127, 6.1.46, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.