CVE-2023-53686— net/handshake: fix null-ptr-deref in handshake_nl_done_doit()
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 6
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-53686
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/handshake: fix null-ptr-deref in handshake_nl_done_doit()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/handshake: fix null-ptr-deref in handshake_nl_done_doit() We should not call trace_handshake_cmd_done_err() if socket lookup has failed. Also we should call trace_handshake_cmd_done_err() before releasing the file, otherwise dereferencing sock->sk can return garbage. This also reverts 7afc6d0a107f ("net/handshake: Fix uninitialized local variable") Unable to handle kernel paging request at virtual address dfff800000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000003] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 5986 Comm: syz-executor292 Not tainted 6.5.0-rc7-syzkaller-gfe4469582053 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : handshake_nl_done_doit+0x198/0x9c8 net/handshake/netlink.c:193 lr : handshake_nl_done_doit+0x180/0x9c8 sp : ffff800096e37180 x29: ffff800096e37200 x28: 1ffff00012dc6e34 x27: dfff800000000000 x26: ffff800096e373d0 x25: 0000000000000000 x24: 00000000ffffffa8 x23: ffff800096e373f0 x22: 1ffff00012dc6e38 x21: 0000000000000000 x20: ffff800096e371c0 x19: 0000000000000018 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800080516cc4 x15: 0000000000000001 x14: 1fffe0001b14aa3b x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000003 x8 : 0000000000000003 x7 : ffff800080afe47c x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080a88078 x2 : 0000000000000001 x1 : 00000000ffffffa8 x0 : 0000000000000000 Call trace: handshake_nl_done_doit+0x198/0x9c8 net/handshake/netlink.c:193 genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline] genl_rcv_msg+0x96c/0xc50 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2549 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1078 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x834/0xb18 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg net/socket.c:748 [inline] ____sys_sendmsg+0x56c/0x840 net/socket.c:2494 ___sys_sendmsg net/socket.c:2548 [inline] __sys_sendmsg+0x26c/0x33c net/socket.c:2577 __do_sys_sendmsg net/socket.c:2586 [inline] __se_sys_sendmsg net/socket.c:2584 [inline] __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2584 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: 12800108 b90043e8 910062b3 d343fe68 (387b6908)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-53686
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-53686
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-53686 (2)
Same Patch Batch · Linux · 2025-10-07 · 118 CVEs total
| CVE-2023-53629 | 9.8 CRITICAL | fs: dlm: fix use after free in midcomms commit |
| CVE-2023-53630 | 8.8 HIGH | iommufd: Fix unpinning of pages when an access is present |
| CVE-2023-53676 | 8.8 HIGH | scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() |
| CVE-2023-53675 | 8.8 HIGH | scsi: ses: Fix possible desc_ptr out-of-bounds accesses |
| CVE-2023-53673 | 8.8 HIGH | Bluetooth: hci_event: call disconnect callback before deleting conn |
| CVE-2023-53679 | 8.3 HIGH | wifi: mt7601u: fix an integer underflow |
| CVE-2023-53635 | 8.2 HIGH | netfilter: conntrack: fix wrong ct->timeout value |
| CVE-2023-53669 | 7.8 HIGH | tcp: fix skb_copy_ubufs() vs BIG TCP |
| CVE-2022-50555 | 7.8 HIGH | tipc: fix a null-ptr-deref in tipc_topsrv_accept |
| CVE-2023-53627 | 7.8 HIGH | scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list |
| CVE-2023-53626 | 7.8 HIGH | ext4: fix possible double unlock when moving a directory |
| CVE-2023-53660 | 7.8 HIGH | bpf, cpumap: Handle skb as well when clean up ptr_ring |
| CVE-2023-53659 | 7.8 HIGH | iavf: Fix out-of-bounds when setting channels on remove |
| CVE-2023-53619 | 7.8 HIGH | netfilter: conntrack: Avoid nf_ct_helper_hash uses after free |
| CVE-2023-53643 | 7.8 HIGH | nvme-tcp: don't access released socket during error recovery |
| CVE-2023-53645 | 7.8 HIGH | bpf: Make bpf_refcount_acquire fallible for non-owning refs |
| CVE-2023-53646 | 7.8 HIGH | drm/i915/perf: add sentinel to xehp_oa_b_counters |
| CVE-2022-50528 | 7.8 HIGH | drm/amdkfd: Fix memory leakage |
| CVE-2023-53651 | 7.8 HIGH | Input: exc3000 - properly stop timer on shutdown |
| CVE-2023-53674 | 7.8 HIGH | clk: Fix memory leak in devm_clk_notifier_register() |
Showing top 20 of 118 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68081
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to - CVE-2026-68082
libceph: fix two unsafe bare decodes in decode_lockers() - CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ
Same vendor: Linux
- CVE-2026-68081
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to - CVE-2026-68082
libceph: fix two unsafe bare decodes in decode_lockers() - CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ
V. Comments for CVE-2023-53686
No comments yet