# CVE-2023-53186: linux: In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releas... CVE-2023-53186 is fixed in 20 products on 1 platform, first by ALAS2023-2023-169, released April 27, 2023. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2023-53186 - Priority: Routine - CVSS: 4.7 (medium) - EPSS: 0.0027 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 27, 2023 ## Description In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in this situation. If the other cloned SKB is released while the merging is in process, from_shinfo->nr_frags will be set to 0 toward the end of the function, causing the increment of frag page _refcount to be unexpectedly skipped resulting in inconsistent reference counts. Later when SKB(@to) is released, it frees the page directly even though the page pool page is still in use, leading to use-after-free or double-free errors. So it should be prohibited. The double-free error message below prompted us to investigate: BUG: Bad page state in process swapper/1 pfn:0e0d1 page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0xe0d1 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 page dumped because: nonzero _refcount CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ Call Trace: dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_pcp_prepare+0x260/0x2f0 free_unref_page+0x20/0x1c0 skb_release_data+0x10b/0x1a0 napi_consume_skb+0x56/0x150 net_rx_action+0xf0/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xc8/0x2b1 __irq_exit_rcu+0xb9/0xf0 common_interrupt+0x82/0xa0 asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0xb/0x20 ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | bpftool-debuginfo amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-debuginfo amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-debuginfo-common-aarch64 amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-debuginfo-common-x86_64 amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-devel amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-headers amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-libbpf amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-libbpf-devel amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-libbpf-static amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-livepatch-6.1.25-37.47 amzn 2023 | 1.0-0.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-tools amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-tools-debuginfo amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | kernel-tools-devel amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | linux Debian 12.15 (bookworm) | 6.1.25-1 | [DEBIAN-CVE-2023-53186](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53186.md) | Sep 15, 2025 | | Linux | linux Debian 13.5 (trixie) | 6.1.25-1 | [DEBIAN-CVE-2023-53186](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53186.md) | Sep 15, 2025 | | Linux | linux Debian 14 | 6.1.25-1 | [DEBIAN-CVE-2023-53186](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53186.md) | Sep 15, 2025 | | Linux | perf amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | perf-debuginfo amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | python3-perf amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | | Linux | python3-perf-debuginfo amzn 2023 | 6.1.25-37.47.amzn2023 | [ALAS2023-2023-169](https://patchblox.com/security/data/fix/linux/alas2023-2023-169.md) | Apr 27, 2023 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.