{
  "cveId": "CVE-2023-53667",
  "url": "https://patchblox.com/security/cve/CVE-2023-53667",
  "summary": "CVE-2023-53667 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53667, released October 7, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: cdc_ncm: Deal with too low values of dwNtbO...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize  Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated \u0022min\u0022 value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled.  For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time: \tsize = SKB_DATA_ALIGN(size);         size \u002B= SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 (\u0022net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero\u0022)  Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b).  However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say \u0027struct skb_shared_info\u0027, increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b).  Consequently the SKB bounds checking semantics fails and panics:  skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:\u003CNULL\u003E ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic\u002B0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace:  \u003CTASK\u003E  skb_put\u002B0x151/0x210 net/core/skbuff.c:2047  skb_put_zero include/linux/skbuff.h:2422 [inline]  cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]  cdc_ncm_fill_tx_frame\u002B0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308  cdc_ncm_tx_fixup\u002B0xa3/0x100  Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.",
  "published": "2025-10-07T16:15:50Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00149,
  "epssPercentile": 0.04084,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.37-1",
      "fix": "DEBIAN-CVE-2023-53667",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53667",
      "released": "2025-10-07T16:15:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.3.7-1",
      "fix": "DEBIAN-CVE-2023-53667",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53667",
      "released": "2025-10-07T16:15:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.3.7-1",
      "fix": "DEBIAN-CVE-2023-53667",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53667",
      "released": "2025-10-07T16:15:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}