# CVE-2023-52906: linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: act_mpls: Fix warning during failed a...

CVE-2023-52906 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52906, released August 21, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-52906
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 21, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  net/sched: act_mpls: Fix warning during failed attribute validation  The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above 'struct nla_policy':  " Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN:    NLA_BINARY           Validation function called for the attribute.    All other            Unused - but note that it's a union "  This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32' type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate' field.  Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function.  No regressions in MPLS tests:   # ./tdc.py -f tc-tests/actions/mpls.json  [...]  # echo $?  0  [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace:  <TASK>  __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310  netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411  netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline]  netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506  netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546  rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109  netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]  netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345  netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921  sock_sendmsg_nosec net/socket.c:714 [inline]  sock_sendmsg net/socket.c:734 [inline]  ____sys_sendmsg+0x38f/0x500 net/socket.c:2482  ___sys_sendmsg net/socket.c:2536 [inline]  __sys_sendmsg+0x197/0x230 net/socket.c:2565  __do_sys_sendmsg net/socket.c:2574 [inline]  __se_sys_sendmsg net/socket.c:2572 [inline]  __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.7-1 | [DEBIAN-CVE-2023-52906](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52906.md) | Aug 21, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.1.7-1 | [DEBIAN-CVE-2023-52906](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52906.md) | Aug 21, 2024 |
| Linux | linux Debian 14 | 6.1.7-1 | [DEBIAN-CVE-2023-52906](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52906.md) | Aug 21, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.