{
  "cveId": "CVE-2023-53109",
  "url": "https://patchblox.com/security/cve/CVE-2023-53109",
  "summary": "CVE-2023-53109 is fixed in 20 products on 1 platform, first by ALAS2023-2023-148, released March 30, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: tunnels: annotate lockless accesses to dev-...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: tunnels: annotate lockless accesses to dev-\u003Eneeded_headroom  IP tunnels can apparently update dev-\u003Eneeded_headroom in their xmit path.  This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers.  More changes might be needed for completeness.  BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit  read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit\u002B0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit\u002B0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit\u002B0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit\u002B0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output\u002B0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2\u002B0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output\u002B0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output\u002B0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out\u002B0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit\u002B0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit\u002B0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit\u002B0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit\u002B0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit\u002B0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output\u002B0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2\u002B0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output\u002B0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output\u002B0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out\u002B0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit\u002B0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit\u002B0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit\u002B0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit\u002B0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit\u002B0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output\u002B0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2\u002B0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output\u002B0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output\u002B0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out\u002B0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit\u002B0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit\u002B0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit\u002B0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit\u002B0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit\u002B0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output\u002B0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2\u002B0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output\u002B0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output\u002B0xe5/0x1b0 net/i ---truncated---",
  "published": "2023-03-30T21:11:00Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00202,
  "epssPercentile": 0.10259,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-headers",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf-static",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.1.21-1.45",
      "release": "amzn 2023",
      "fixedVersion": "1.0-0.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.25-1",
      "fix": "DEBIAN-CVE-2023-53109",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53109",
      "released": "2025-05-02T16:15:29Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.25-1",
      "fix": "DEBIAN-CVE-2023-53109",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53109",
      "released": "2025-05-02T16:15:29Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.25-1",
      "fix": "DEBIAN-CVE-2023-53109",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53109",
      "released": "2025-05-02T16:15:29Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "perf-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.21-1.45.amzn2023",
      "fix": "ALAS2023-2023-148",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-148",
      "released": "2023-03-30T21:11:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}