{
  "cveId": "CVE-2023-53190",
  "url": "https://patchblox.com/security/cve/CVE-2023-53190",
  "summary": "CVE-2023-53190 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53190, released September 15, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  vxlan: Fix memory leaks in error path  The memor...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  vxlan: Fix memory leaks in error path  The memory allocated by vxlan_vnigroup_init() is not freed in the error path, leading to memory leaks [1]. Fix by calling vxlan_vnigroup_uninit() in the error path.  The leaks can be reproduced by annotating gro_cells_init() with ALLOW_ERROR_INJECTION() and then running:   # echo \u0022100\u0022 \u003E /sys/kernel/debug/fail_function/probability  # echo \u00221\u0022 \u003E /sys/kernel/debug/fail_function/times  # echo \u0022gro_cells_init\u0022 \u003E /sys/kernel/debug/fail_function/inject  # printf %#x -12 \u003E /sys/kernel/debug/fail_function/gro_cells_init/retval  # ip link add name vxlan0 type vxlan dstport 4789 external vnifilter  RTNETLINK answers: Cannot allocate memory  [1] unreferenced object 0xffff88810db84a00 (size 512):   comm \u0022ip\u0022, pid 330, jiffies 4295010045 (age 66.016s)   hex dump (first 32 bytes):     f8 d5 76 0e 81 88 ff ff 01 00 00 00 00 00 00 02  ..v.............     03 00 04 00 48 00 00 00 00 00 00 01 04 00 01 00  ....H...........   backtrace:     [\u003Cffffffff81a3097a\u003E] kmalloc_trace\u002B0x2a/0x60     [\u003Cffffffff82f049fc\u003E] vxlan_vnigroup_init\u002B0x4c/0x160     [\u003Cffffffff82ecd69e\u003E] vxlan_init\u002B0x1ae/0x280     [\u003Cffffffff836858ca\u003E] register_netdevice\u002B0x57a/0x16d0     [\u003Cffffffff82ef67b7\u003E] __vxlan_dev_create\u002B0x7c7/0xa50     [\u003Cffffffff82ef6ce6\u003E] vxlan_newlink\u002B0xd6/0x130     [\u003Cffffffff836d02ab\u003E] __rtnl_newlink\u002B0x112b/0x18a0     [\u003Cffffffff836d0a8c\u003E] rtnl_newlink\u002B0x6c/0xa0     [\u003Cffffffff836c0ddf\u003E] rtnetlink_rcv_msg\u002B0x43f/0xd40     [\u003Cffffffff83908ce0\u003E] netlink_rcv_skb\u002B0x170/0x440     [\u003Cffffffff839066af\u003E] netlink_unicast\u002B0x53f/0x810     [\u003Cffffffff839072d8\u003E] netlink_sendmsg\u002B0x958/0xe70     [\u003Cffffffff835c319f\u003E] ____sys_sendmsg\u002B0x78f/0xa90     [\u003Cffffffff835cd6da\u003E] ___sys_sendmsg\u002B0x13a/0x1e0     [\u003Cffffffff835cd94c\u003E] __sys_sendmsg\u002B0x11c/0x1f0     [\u003Cffffffff8424da78\u003E] do_syscall_64\u002B0x38/0x80 unreferenced object 0xffff88810e76d5f8 (size 192):   comm \u0022ip\u0022, pid 330, jiffies 4295010045 (age 66.016s)   hex dump (first 32 bytes):     04 00 00 00 00 00 00 00 db e1 4f e7 00 00 00 00  ..........O.....     08 d6 76 0e 81 88 ff ff 08 d6 76 0e 81 88 ff ff  ..v.......v.....   backtrace:     [\u003Cffffffff81a3162e\u003E] __kmalloc_node\u002B0x4e/0x90     [\u003Cffffffff81a0e166\u003E] kvmalloc_node\u002B0xa6/0x1f0     [\u003Cffffffff8276e1a3\u003E] bucket_table_alloc.isra.0\u002B0x83/0x460     [\u003Cffffffff8276f18b\u003E] rhashtable_init\u002B0x43b/0x7c0     [\u003Cffffffff82f04a1c\u003E] vxlan_vnigroup_init\u002B0x6c/0x160     [\u003Cffffffff82ecd69e\u003E] vxlan_init\u002B0x1ae/0x280     [\u003Cffffffff836858ca\u003E] register_netdevice\u002B0x57a/0x16d0     [\u003Cffffffff82ef67b7\u003E] __vxlan_dev_create\u002B0x7c7/0xa50     [\u003Cffffffff82ef6ce6\u003E] vxlan_newlink\u002B0xd6/0x130     [\u003Cffffffff836d02ab\u003E] __rtnl_newlink\u002B0x112b/0x18a0     [\u003Cffffffff836d0a8c\u003E] rtnl_newlink\u002B0x6c/0xa0     [\u003Cffffffff836c0ddf\u003E] rtnetlink_rcv_msg\u002B0x43f/0xd40     [\u003Cffffffff83908ce0\u003E] netlink_rcv_skb\u002B0x170/0x440     [\u003Cffffffff839066af\u003E] netlink_unicast\u002B0x53f/0x810     [\u003Cffffffff839072d8\u003E] netlink_sendmsg\u002B0x958/0xe70     [\u003Cffffffff835c319f\u003E] ____sys_sendmsg\u002B0x78f/0xa90",
  "published": "2025-09-15T14:15:41Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00177,
  "epssPercentile": 0.07348,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-53190",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53190",
      "released": "2025-09-15T14:15:41Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-53190",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53190",
      "released": "2025-09-15T14:15:41Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-53190",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53190",
      "released": "2025-09-15T14:15:41Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}