SECUFOCUSNOW
Home›CVE index›CVE-2023-53492
Review reviewHigh

CVE-2023-53492

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #4...

CVSS
7.8
EPSS
0.15%
5.07% percentile
CISA KEV
Not listed
Published
2025.10.01
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.15%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #4...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 837830a4b439bfeb86c70b0115c280377c84714b < 4ae2e501331aaa506eaf760339bb2f43e5769395, >= 837830a4b439bfeb86c70b0115c280377c84714b < 041e2ac88caef286b39064e83e825e3f53113d36, >= 837830a4b439bfeb86c70b0115c280377c84714b < fc95c8b02c6160936f1f3d8d9d7f4f66f3c84b49, >= 837830a4b439bfeb86c70b0115c280377c84714b < 5e5e967e8505fbdabfb6497367ec1b808cadc356, >= 837830a4b439bfeb86c70b0115c280377c84714b < 515ad530795c118f012539ed76d02bacfd426d89, >= 5.9, >= 5.9 < 5.10.188, >= 5.11 < 5.15.121, >= 5.16 < 6.1.39, >= 6.2 < 6.4.4, 6.5
Fixed versions
5.10.188, 5.15.121, 6.1.39, 6.4.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available