GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53088 (GCVE-0-2023-53088)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
mptcp: fix UaF in listener shutdown
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0 Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266 CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 kasan_check_range+0x14a/0x1a0 _raw_spin_lock_bh+0x73/0xe0 subflow_error_report+0x6d/0x110 sk_error_report+0x3b/0x190 tcp_disconnect+0x138c/0x1aa0 inet_child_forget+0x6f/0x2e0 inet_csk_listen_stop+0x209/0x1060 __mptcp_close_ssk+0x52d/0x610 mptcp_destroy_common+0x165/0x640 mptcp_destroy+0x13/0x80 __mptcp_destroy_sock+0xe7/0x270 __mptcp_close+0x70e/0x9b0 mptcp_close+0x2b/0x150 inet_release+0xe9/0x1f0 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The msk grace period can legitly expire in between the last reference count dropped in mptcp_subflow_queue_clean() and the later eventual access in inet_csk_listen_stop() After the previous patch we don't need anymore special-casing msk listener socket cleanup: the mptcp worker will process each of the unaccepted msk sockets. Just drop the now unnecessary code. Please note this commit depends on the two parent ones: mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 , < 5564be74a22a61855f8b8c100d8c4abb003bb792 (git)
Affected: 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 , < 0f4f4cf5d32f10543deb946a37111e714579511e (git)
Affected: 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 , < 0a3f4f1f9c27215e4ddcd312558342e57b93e518 (git)
Affected: a8a3e95c74e48c2c9b07b81fafda9122993f2e12 (git)
Affected: 5.18.10 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.22 , ≤ 6.1.* (semver)
Unaffected: 6.2.8 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5564be74a22a61855f8b8c100d8c4abb003bb792",
              "status": "affected",
              "version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
              "versionType": "git"
            },
            {
              "lessThan": "0f4f4cf5d32f10543deb946a37111e714579511e",
              "status": "affected",
              "version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
              "versionType": "git"
            },
            {
              "lessThan": "0a3f4f1f9c27215e4ddcd312558342e57b93e518",
              "status": "affected",
              "version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a8a3e95c74e48c2c9b07b81fafda9122993f2e12",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix UaF in listener shutdown\n\nAs reported by Christoph after having refactored the passive\nsocket initialization, the mptcp listener shutdown path is prone\nto an UaF issue.\n\n  BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0\n  Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266\n\n  CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6e/0x91\n   print_report+0x16a/0x46f\n   kasan_report+0xad/0x130\n   kasan_check_range+0x14a/0x1a0\n   _raw_spin_lock_bh+0x73/0xe0\n   subflow_error_report+0x6d/0x110\n   sk_error_report+0x3b/0x190\n   tcp_disconnect+0x138c/0x1aa0\n   inet_child_forget+0x6f/0x2e0\n   inet_csk_listen_stop+0x209/0x1060\n   __mptcp_close_ssk+0x52d/0x610\n   mptcp_destroy_common+0x165/0x640\n   mptcp_destroy+0x13/0x80\n   __mptcp_destroy_sock+0xe7/0x270\n   __mptcp_close+0x70e/0x9b0\n   mptcp_close+0x2b/0x150\n   inet_release+0xe9/0x1f0\n   __sock_release+0xd2/0x280\n   sock_close+0x15/0x20\n   __fput+0x252/0xa20\n   task_work_run+0x169/0x250\n   exit_to_user_mode_prepare+0x113/0x120\n   syscall_exit_to_user_mode+0x1d/0x40\n   do_syscall_64+0x48/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThe msk grace period can legitly expire in between the last\nreference count dropped in mptcp_subflow_queue_clean() and\nthe later eventual access in inet_csk_listen_stop()\n\nAfter the previous patch we don\u0027t need anymore special-casing\nmsk listener socket cleanup: the mptcp worker will process each\nof the unaccepted msk sockets.\n\nJust drop the now unnecessary code.\n\nPlease note this commit depends on the two parent ones:\n\n  mptcp: refactor passive socket initialization\n  mptcp: use the workqueue to destroy unaccepted sockets"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by closing a local MPTCP listening socket that still has unaccepted connections; the entry path is socket/bind/listen/connect/close syscalls, not remote packet processing alone.\nAC:L - The attacker fully controls both the listener and the connecting peer and can force the close path that frees the msk then reuses it; the RCU window is schedulable (mutex between sock_put and inet_csk_listen_stop) and was reliably hit by syzkaller reproducers.\nPR:L - Creating and listening on IPPROTO_MPTCP sockets requires only an unprivileged local account (mptcp enabled by default; no CAP_* on the trigger path), including inside user/net namespaces.\nUI:N - Exploitation uses only the attacker\u0027s own sockets and close(); no victim action is required.\nS:U - This is a same-host kernel memory-corruption privilege-escalation class bug; impact stays within the kernel\u0027s security authority with no VM/IOMMU boundary crossed.\nC:H - The UAF targets a full mptcp/struct sock object in kmalloc-2k; after RCU free the attacker can reclaim and read through the dangling subflow-\u003econn reference.\nI:H - Reclaiming the freed sock enables controlled writes and control-flow hijack via the subsequent subflow_error_report/mptcp_data_lock path on attacker-influenced memory.\nA:H - The UAF already produces a KASAN-detectable kernel write-after-free/oops on the spinlock path, so availability impact is a full kernel crash even without further exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:43.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5564be74a22a61855f8b8c100d8c4abb003bb792"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f4f4cf5d32f10543deb946a37111e714579511e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a3f4f1f9c27215e4ddcd312558342e57b93e518"
        }
      ],
      "title": "mptcp: fix UaF in listener shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53088",
    "datePublished": "2025-05-02T15:55:34.840Z",
    "dateReserved": "2025-05-02T15:51:43.551Z",
    "dateUpdated": "2026-08-05T09:12:43.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53088",
      "date": "2026-09-16",
      "epss": "0.00196",
      "percentile": "0.09539"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53088\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:27.760\",\"lastModified\":\"2026-08-04T10:18:54.637\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix UaF in listener shutdown\\n\\nAs reported by Christoph after having refactored the passive\\nsocket initialization, the mptcp listener shutdown path is prone\\nto an UaF issue.\\n\\n  BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0\\n  Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266\\n\\n  CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6e/0x91\\n   print_report+0x16a/0x46f\\n   kasan_report+0xad/0x130\\n   kasan_check_range+0x14a/0x1a0\\n   _raw_spin_lock_bh+0x73/0xe0\\n   subflow_error_report+0x6d/0x110\\n   sk_error_report+0x3b/0x190\\n   tcp_disconnect+0x138c/0x1aa0\\n   inet_child_forget+0x6f/0x2e0\\n   inet_csk_listen_stop+0x209/0x1060\\n   __mptcp_close_ssk+0x52d/0x610\\n   mptcp_destroy_common+0x165/0x640\\n   mptcp_destroy+0x13/0x80\\n   __mptcp_destroy_sock+0xe7/0x270\\n   __mptcp_close+0x70e/0x9b0\\n   mptcp_close+0x2b/0x150\\n   inet_release+0xe9/0x1f0\\n   __sock_release+0xd2/0x280\\n   sock_close+0x15/0x20\\n   __fput+0x252/0xa20\\n   task_work_run+0x169/0x250\\n   exit_to_user_mode_prepare+0x113/0x120\\n   syscall_exit_to_user_mode+0x1d/0x40\\n   do_syscall_64+0x48/0x90\\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\nThe msk grace period can legitly expire in between the last\\nreference count dropped in mptcp_subflow_queue_clean() and\\nthe later eventual access in inet_csk_listen_stop()\\n\\nAfter the previous patch we don\u0027t need anymore special-casing\\nmsk listener socket cleanup: the mptcp worker will process each\\nof the unaccepted msk sockets.\\n\\nJust drop the now unnecessary code.\\n\\nPlease note this commit depends on the two parent ones:\\n\\n  mptcp: refactor passive socket initialization\\n  mptcp: use the workqueue to destroy unaccepted sockets\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: correcci\u00f3n de UaF en el apagado del oyente Como inform\u00f3 Christoph despu\u00e9s de haber refactorizado la inicializaci\u00f3n del socket pasivo, la ruta de apagado del oyente mptcp es propensa a un problema de UaF. ERROR: KASAN: use-after-free en _raw_spin_lock_bh+0x73/0xe0 Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff88810cb23098 por la tarea syz-executor731/1266 CPU: 1 PID: 1266 Comm: syz-executor731 No contaminado 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 Rastreo de llamadas:  dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 kasan_check_range+0x14a/0x1a0 _raw_spin_lock_bh+0x73/0xe0 subflow_error_report+0x6d/0x110 sk_error_report+0x3b/0x190 tcp_disconnect+0x138c/0x1aa0 inet_child_forget+0x6f/0x2e0 inet_csk_listen_stop+0x209/0x1060 __mptcp_close_ssk+0x52d/0x610 mptcp_destroy_common+0x165/0x640 mptcp_destroy+0x13/0x80 __mptcp_destroy_sock+0xe7/0x270 __mptcp_close+0x70e/0x9b0 mptcp_close+0x2b/0x150 inet_release+0xe9/0x1f0 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc puede expirar leg\u00edtimamente entre el \u00faltimo recuento de referencias introducido en mptcp_subflow_queue_clean() y el acceso eventual posterior en inet_csk_listen_stop(). Tras la actualizaci\u00f3n anterior, ya no necesitamos la limpieza de sockets del receptor MSK con casos especiales: el trabajador de mptcp procesar\u00e1 cada uno de los sockets MSK no aceptados. Simplemente elimine el c\u00f3digo innecesario. Tenga en cuenta que esta confirmaci\u00f3n depende de las dos principales: mptcp: refactorizar la inicializaci\u00f3n pasiva de sockets. mptcp: usar la cola de trabajo para eliminar los sockets no aceptados.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/protocol.c\",\"net/mptcp/protocol.h\",\"net/mptcp/subflow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\",\"lessThan\":\"5564be74a22a61855f8b8c100d8c4abb003bb792\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\",\"lessThan\":\"0f4f4cf5d32f10543deb946a37111e714579511e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\",\"lessThan\":\"0a3f4f1f9c27215e4ddcd312558342e57b93e518\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a8a3e95c74e48c2c9b07b81fafda9122993f2e12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.18.10\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/protocol.c\",\"net/mptcp/protocol.h\",\"net/mptcp/subflow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.22\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.8\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.10\",\"versionEndExcluding\":\"5.19\",\"matchCriteriaId\":\"A10D4E7E-4972-474E-997B-01A4DD4EB6B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.1\",\"versionEndExcluding\":\"6.1.22\",\"matchCriteriaId\":\"61342A44-98AA-4789-9DE4-4F44CEA19A23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.8\",\"matchCriteriaId\":\"4011EC6B-7786-4709-B765-186FA31D6F7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D759CCF-9E1B-41B2-81AA-CB580C5F3EEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"00AE778B-BAEE-49EB-9F84-003B73D7862A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C178431E-AD82-4B3D-B70F-A273A02ABD5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CF5D19C-C418-4B57-B52D-7795547F4096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a3f4f1f9c27215e4ddcd312558342e57b93e518\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f4f4cf5d32f10543deb946a37111e714579511e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5564be74a22a61855f8b8c100d8c4abb003bb792\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:20:45+00:00",
      "cve": "CVE-2023-53088",
      "id": "CVE-2023-53088",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: fix UaF in listener shutdown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53088.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:01:25Z",
      "cve": "CVE-2023-53088",
      "id": "CVE-2023-53088",
      "initial_release_date": "2025-05-03T02:50:56Z",
      "product_status:known_not_affected": "505",
      "product_status:recommended": "49",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53088",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53088.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.