GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53855 (GCVE-0-2023-53855)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:30 – Updated: 2026-05-11 19:52
VLAI
Title
net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove When the tagging protocol in current use is "ocelot-8021q" and we unbind the driver, we see this splat: $ echo '0000:00:00.2' > /sys/bus/pci/drivers/fsl_enetc/unbind mscc_felix 0000:00:00.5 swp0: left promiscuous mode sja1105 spi2.0: Link is Down DSA: tree 1 torn down mscc_felix 0000:00:00.5 swp2: left promiscuous mode sja1105 spi2.2: Link is Down DSA: tree 3 torn down fsl_enetc 0000:00:00.2 eno2: left promiscuous mode mscc_felix 0000:00:00.5: Link is Down ------------[ cut here ]------------ RTNL: assertion failed at net/dsa/tag_8021q.c (409) WARNING: CPU: 1 PID: 329 at net/dsa/tag_8021q.c:409 dsa_tag_8021q_unregister+0x12c/0x1a0 Modules linked in: CPU: 1 PID: 329 Comm: bash Not tainted 6.5.0-rc3+ #771 pc : dsa_tag_8021q_unregister+0x12c/0x1a0 lr : dsa_tag_8021q_unregister+0x12c/0x1a0 Call trace: dsa_tag_8021q_unregister+0x12c/0x1a0 felix_tag_8021q_teardown+0x130/0x150 felix_teardown+0x3c/0xd8 dsa_tree_teardown_switches+0xbc/0xe0 dsa_unregister_switch+0x168/0x260 felix_pci_remove+0x30/0x60 pci_device_remove+0x4c/0x100 device_release_driver_internal+0x188/0x288 device_links_unbind_consumers+0xfc/0x138 device_release_driver_internal+0xe0/0x288 device_driver_detach+0x24/0x38 unbind_store+0xd8/0x108 drv_attr_store+0x30/0x50 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ RTNL: assertion failed at net/8021q/vlan_core.c (376) WARNING: CPU: 1 PID: 329 at net/8021q/vlan_core.c:376 vlan_vid_del+0x1b8/0x1f0 CPU: 1 PID: 329 Comm: bash Tainted: G W 6.5.0-rc3+ #771 pc : vlan_vid_del+0x1b8/0x1f0 lr : vlan_vid_del+0x1b8/0x1f0 dsa_tag_8021q_unregister+0x8c/0x1a0 felix_tag_8021q_teardown+0x130/0x150 felix_teardown+0x3c/0xd8 dsa_tree_teardown_switches+0xbc/0xe0 dsa_unregister_switch+0x168/0x260 felix_pci_remove+0x30/0x60 pci_device_remove+0x4c/0x100 device_release_driver_internal+0x188/0x288 device_links_unbind_consumers+0xfc/0x138 device_release_driver_internal+0xe0/0x288 device_driver_detach+0x24/0x38 unbind_store+0xd8/0x108 drv_attr_store+0x30/0x50 DSA: tree 0 torn down This was somewhat not so easy to spot, because "ocelot-8021q" is not the default tagging protocol, and thus, not everyone who tests the unbinding path may have switched to it beforehand. The default felix_tag_npi_teardown() does not require rtnl_lock() to be held.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c83a7c539abe9f980996063ac20532a7a7f6eb1 , < 758dbcfb257e1aee0a310bae789c2af6ffe35d0f (git)
Affected: 7c83a7c539abe9f980996063ac20532a7a7f6eb1 , < 7ae8fa6b70975b6efbbef7912d09bff5a0bff491 (git)
Affected: 7c83a7c539abe9f980996063ac20532a7a7f6eb1 , < a94c16a2fda010866b8858a386a8bfbeba4f72c5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.1.46 , ≤ 6.1.* (semver)
Unaffected: 6.4.11 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/ocelot/felix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "758dbcfb257e1aee0a310bae789c2af6ffe35d0f",
              "status": "affected",
              "version": "7c83a7c539abe9f980996063ac20532a7a7f6eb1",
              "versionType": "git"
            },
            {
              "lessThan": "7ae8fa6b70975b6efbbef7912d09bff5a0bff491",
              "status": "affected",
              "version": "7c83a7c539abe9f980996063ac20532a7a7f6eb1",
              "versionType": "git"
            },
            {
              "lessThan": "a94c16a2fda010866b8858a386a8bfbeba4f72c5",
              "status": "affected",
              "version": "7c83a7c539abe9f980996063ac20532a7a7f6eb1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/ocelot/felix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.46",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.11",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove\n\nWhen the tagging protocol in current use is \"ocelot-8021q\" and we unbind\nthe driver, we see this splat:\n\n$ echo \u00270000:00:00.2\u0027 \u003e /sys/bus/pci/drivers/fsl_enetc/unbind\nmscc_felix 0000:00:00.5 swp0: left promiscuous mode\nsja1105 spi2.0: Link is Down\nDSA: tree 1 torn down\nmscc_felix 0000:00:00.5 swp2: left promiscuous mode\nsja1105 spi2.2: Link is Down\nDSA: tree 3 torn down\nfsl_enetc 0000:00:00.2 eno2: left promiscuous mode\nmscc_felix 0000:00:00.5: Link is Down\n------------[ cut here ]------------\nRTNL: assertion failed at net/dsa/tag_8021q.c (409)\nWARNING: CPU: 1 PID: 329 at net/dsa/tag_8021q.c:409 dsa_tag_8021q_unregister+0x12c/0x1a0\nModules linked in:\nCPU: 1 PID: 329 Comm: bash Not tainted 6.5.0-rc3+ #771\npc : dsa_tag_8021q_unregister+0x12c/0x1a0\nlr : dsa_tag_8021q_unregister+0x12c/0x1a0\nCall trace:\n dsa_tag_8021q_unregister+0x12c/0x1a0\n felix_tag_8021q_teardown+0x130/0x150\n felix_teardown+0x3c/0xd8\n dsa_tree_teardown_switches+0xbc/0xe0\n dsa_unregister_switch+0x168/0x260\n felix_pci_remove+0x30/0x60\n pci_device_remove+0x4c/0x100\n device_release_driver_internal+0x188/0x288\n device_links_unbind_consumers+0xfc/0x138\n device_release_driver_internal+0xe0/0x288\n device_driver_detach+0x24/0x38\n unbind_store+0xd8/0x108\n drv_attr_store+0x30/0x50\n---[ end trace 0000000000000000 ]---\n------------[ cut here ]------------\nRTNL: assertion failed at net/8021q/vlan_core.c (376)\nWARNING: CPU: 1 PID: 329 at net/8021q/vlan_core.c:376 vlan_vid_del+0x1b8/0x1f0\nCPU: 1 PID: 329 Comm: bash Tainted: G        W          6.5.0-rc3+ #771\npc : vlan_vid_del+0x1b8/0x1f0\nlr : vlan_vid_del+0x1b8/0x1f0\n dsa_tag_8021q_unregister+0x8c/0x1a0\n felix_tag_8021q_teardown+0x130/0x150\n felix_teardown+0x3c/0xd8\n dsa_tree_teardown_switches+0xbc/0xe0\n dsa_unregister_switch+0x168/0x260\n felix_pci_remove+0x30/0x60\n pci_device_remove+0x4c/0x100\n device_release_driver_internal+0x188/0x288\n device_links_unbind_consumers+0xfc/0x138\n device_release_driver_internal+0xe0/0x288\n device_driver_detach+0x24/0x38\n unbind_store+0xd8/0x108\n drv_attr_store+0x30/0x50\nDSA: tree 0 torn down\n\nThis was somewhat not so easy to spot, because \"ocelot-8021q\" is not the\ndefault tagging protocol, and thus, not everyone who tests the unbinding\npath may have switched to it beforehand. The default\nfelix_tag_npi_teardown() does not require rtnl_lock() to be held."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:52:49.268Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/758dbcfb257e1aee0a310bae789c2af6ffe35d0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ae8fa6b70975b6efbbef7912d09bff5a0bff491"
        },
        {
          "url": "https://git.kernel.org/stable/c/a94c16a2fda010866b8858a386a8bfbeba4f72c5"
        }
      ],
      "title": "net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53855",
    "datePublished": "2025-12-09T01:30:20.864Z",
    "dateReserved": "2025-12-09T01:27:17.828Z",
    "dateUpdated": "2026-05-11T19:52:49.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53855",
      "date": "2026-09-16",
      "epss": "0.00219",
      "percentile": "0.12528"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53855\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:26.173\",\"lastModified\":\"2026-06-17T06:46:11.473\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove\\n\\nWhen the tagging protocol in current use is \\\"ocelot-8021q\\\" and we unbind\\nthe driver, we see this splat:\\n\\n$ echo \u00270000:00:00.2\u0027 \u003e /sys/bus/pci/drivers/fsl_enetc/unbind\\nmscc_felix 0000:00:00.5 swp0: left promiscuous mode\\nsja1105 spi2.0: Link is Down\\nDSA: tree 1 torn down\\nmscc_felix 0000:00:00.5 swp2: left promiscuous mode\\nsja1105 spi2.2: Link is Down\\nDSA: tree 3 torn down\\nfsl_enetc 0000:00:00.2 eno2: left promiscuous mode\\nmscc_felix 0000:00:00.5: Link is Down\\n------------[ cut here ]------------\\nRTNL: assertion failed at net/dsa/tag_8021q.c (409)\\nWARNING: CPU: 1 PID: 329 at net/dsa/tag_8021q.c:409 dsa_tag_8021q_unregister+0x12c/0x1a0\\nModules linked in:\\nCPU: 1 PID: 329 Comm: bash Not tainted 6.5.0-rc3+ #771\\npc : dsa_tag_8021q_unregister+0x12c/0x1a0\\nlr : dsa_tag_8021q_unregister+0x12c/0x1a0\\nCall trace:\\n dsa_tag_8021q_unregister+0x12c/0x1a0\\n felix_tag_8021q_teardown+0x130/0x150\\n felix_teardown+0x3c/0xd8\\n dsa_tree_teardown_switches+0xbc/0xe0\\n dsa_unregister_switch+0x168/0x260\\n felix_pci_remove+0x30/0x60\\n pci_device_remove+0x4c/0x100\\n device_release_driver_internal+0x188/0x288\\n device_links_unbind_consumers+0xfc/0x138\\n device_release_driver_internal+0xe0/0x288\\n device_driver_detach+0x24/0x38\\n unbind_store+0xd8/0x108\\n drv_attr_store+0x30/0x50\\n---[ end trace 0000000000000000 ]---\\n------------[ cut here ]------------\\nRTNL: assertion failed at net/8021q/vlan_core.c (376)\\nWARNING: CPU: 1 PID: 329 at net/8021q/vlan_core.c:376 vlan_vid_del+0x1b8/0x1f0\\nCPU: 1 PID: 329 Comm: bash Tainted: G        W          6.5.0-rc3+ #771\\npc : vlan_vid_del+0x1b8/0x1f0\\nlr : vlan_vid_del+0x1b8/0x1f0\\n dsa_tag_8021q_unregister+0x8c/0x1a0\\n felix_tag_8021q_teardown+0x130/0x150\\n felix_teardown+0x3c/0xd8\\n dsa_tree_teardown_switches+0xbc/0xe0\\n dsa_unregister_switch+0x168/0x260\\n felix_pci_remove+0x30/0x60\\n pci_device_remove+0x4c/0x100\\n device_release_driver_internal+0x188/0x288\\n device_links_unbind_consumers+0xfc/0x138\\n device_release_driver_internal+0xe0/0x288\\n device_driver_detach+0x24/0x38\\n unbind_store+0xd8/0x108\\n drv_attr_store+0x30/0x50\\nDSA: tree 0 torn down\\n\\nThis was somewhat not so easy to spot, because \\\"ocelot-8021q\\\" is not the\\ndefault tagging protocol, and thus, not everyone who tests the unbinding\\npath may have switched to it beforehand. The default\\nfelix_tag_npi_teardown() does not require rtnl_lock() to be held.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/dsa/ocelot/felix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c83a7c539abe9f980996063ac20532a7a7f6eb1\",\"lessThan\":\"758dbcfb257e1aee0a310bae789c2af6ffe35d0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c83a7c539abe9f980996063ac20532a7a7f6eb1\",\"lessThan\":\"7ae8fa6b70975b6efbbef7912d09bff5a0bff491\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c83a7c539abe9f980996063ac20532a7a7f6eb1\",\"lessThan\":\"a94c16a2fda010866b8858a386a8bfbeba4f72c5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/dsa/ocelot/felix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.46\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.11\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/758dbcfb257e1aee0a310bae789c2af6ffe35d0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ae8fa6b70975b6efbbef7912d09bff5a0bff491\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a94c16a2fda010866b8858a386a8bfbeba4f72c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:13:56+00:00",
      "cve": "CVE-2023-53855",
      "id": "CVE-2023-53855",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53855.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-07T16:44:08Z",
      "cve": "CVE-2023-53855",
      "id": "CVE-2023-53855",
      "initial_release_date": "2025-12-10T00:34:31Z",
      "product_status:known_affected": "522",
      "product_status:known_not_affected": "304",
      "product_status:recommended": "212",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53855",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53855.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.