SECUFOCUSNOW
Home›CVE index›CVE-2023-54004
Review reviewHigh

CVE-2023-54004

Linux

In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) We had a similar report [1] for probably sk_memory_allocated_add() in __sk_mem_raise_allocated(), and commit c915fe13cbaa ("udplite: fix NULL pointer dereference") fixed it by setting .memory_allocated for udplite_prot and udplitev6_prot. To fix the variant, we need to set either .sysctl_wmem_offset...

CVSS
7.5
EPSS
0.51%
40.6% percentile
CISA KEV
Not listed
Published
2025.12.24
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.51%
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) We had a similar report [1] for probably sk_memory_allocated_add() in __sk_mem_raise_allocated(), and commit c915fe13cbaa ("udplite: fix NULL pointer dereference") fixed it by setting .memory_allocated for udplite_prot and udplitev6_prot. To fix the variant, we need to set either .sysctl_wmem_offset...

Affected product and versions

Product
Linux
Affected versions
>= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < cc56de054d828935aa37734b479f82fa34b5f9bd, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < 7e3ae83371a4809da6fa3f10ccc430eecef3034a, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < 5014b64e369bdf997935b132a1ac4d64b6e47ad4, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < 387bd0a3af3bdd2b16f8dbef0c9fcccac63000a4, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < 2a112f04629f7839e7cb509b27b8d3b735afe255, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < f04c8eaf45e7dcdfccba936506b1ec592a369fb9, >= 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9 < ad42a35bdfc6d3c0fc4cb4027d7b2757ce665665, >= 4.10
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available
CVE-2023-54004 — Linux | SECUFOCUS NOW