CVE-2023-53535

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53535", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:14:15.919Z", "datePublished": "2025-10-04T15:16:46.583Z", "dateUpdated": "2026-10-15T21:41:30.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:39.345Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is the bcmgenet RX descriptor path executed on every Ethernet/MoCA frame the MAC delivers, so the attacker only needs to inject traffic onto the same L2 segment as the Raspberry Pi 4/CM4 or Broadcom set-top box. An RX buffer length above 2048 requires a link-layer framing/oversize condition that cannot survive routing (UMAC_MAX_FRAME_LEN is 1536 and path MTU caps routed frames), so this is adjacent rather than fully remote.\nAC:L - The attacker fully controls the volume, size and framing of the traffic hitting the MAC and can retry indefinitely at line rate at zero cost; there is no race to win, no memory layout to groom, and no target state the attacker cannot influence. Repeatable free retries against a condition the maintainer describes as occurring during normal reception make this Low.\nPR:N - No account, credential, or capability on the target is needed \u2014 bcmgenet_desc_rx() runs in NAPI softirq context on received frames long before any authentication, filtering, or socket-layer authorization is consulted. Any host on the shared Ethernet/coax segment can reach it.\nUI:N - No victim action is required; the interface merely has to be up and receiving, which is its normal operating state. The vulnerable skb_put() executes automatically for every descriptor processed.\nS:U - The panic and the stale-memory read both occur in the host kernel's own security authority, with no VM, hypervisor, IOMMU, or sandbox boundary crossed. Standard kernel-local impact.\nC:L - For len values between the 2048-byte DMA region and the 2112-byte SKB tailroom, skb_put() succeeds and hands up to 64 bytes of stale per-CPU page_frag memory (leftovers of previously received packets) to the network stack, where a bridging/forwarding deployment can transmit it back onto the wire. The read is hard-capped by skb->end and the IP stack trims it in most paths, so the disclosure is real but strictly bounded.\nI:N - The RDMA ring's DMA_RING_BUF_SIZE is programmed with RX_BUF_LENGTH, so the hardware never writes past the 2048-byte mapping \u2014 the bug is a bogus length report, not an out-of-bounds write. No kernel memory is corrupted and no control-flow or data-write primitive is obtained.\nA:H - Any reported length above 2112 drives skb_put() into skb_over_panic(), which calls BUG() from softirq context, taking the machine down immediately (the unmasked 16-bit shift permits lengths up to 65535, far past the limit). This is a full denial of service reachable from the network with no credentials."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "versions": [{"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "c34b1c0870323649d45c5074828d7f754dea2673", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "87363d1ab55e497702a9506ff423c422639c8a25", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "841881320562cbeac7046b537b91cd000480cea2", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce", "status": "affected", "versionType": "git"}, {"version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "versions": [{"version": "3.15", "status": "affected"}, {"version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.308", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.276", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.235", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.173", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.99", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.16", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2.3", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "4.14.308"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "4.19.276"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.4.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.173"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.99"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.2.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"}, {"url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"}, {"url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"}, {"url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"}, {"url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"}, {"url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"}, {"url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"}, {"url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"}], "title": "net: bcmgenet: Add a check for oversized packets", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:35:28.502360Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:30.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:35:28.502360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:35:29.320Z"}}], "cna": {"title": "net: bcmgenet: Add a check for oversized packets", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is the bcmgenet RX descriptor path executed on every Ethernet/MoCA frame the MAC delivers, so the attacker only needs to inject traffic onto the same L2 segment as the Raspberry Pi 4/CM4 or Broadcom set-top box. An RX buffer length above 2048 requires a link-layer framing/oversize condition that cannot survive routing (UMAC_MAX_FRAME_LEN is 1536 and path MTU caps routed frames), so this is adjacent rather than fully remote.\nAC:L - The attacker fully controls the volume, size and framing of the traffic hitting the MAC and can retry indefinitely at line rate at zero cost; there is no race to win, no memory layout to groom, and no target state the attacker cannot influence. Repeatable free retries against a condition the maintainer describes as occurring during normal reception make this Low.\nPR:N - No account, credential, or capability on the target is needed \u2014 bcmgenet_desc_rx() runs in NAPI softirq context on received frames long before any authentication, filtering, or socket-layer authorization is consulted. Any host on the shared Ethernet/coax segment can reach it.\nUI:N - No victim action is required; the interface merely has to be up and receiving, which is its normal operating state. The vulnerable skb_put() executes automatically for every descriptor processed.\nS:U - The panic and the stale-memory read both occur in the host kernel's own security authority, with no VM, hypervisor, IOMMU, or sandbox boundary crossed. Standard kernel-local impact.\nC:L - For len values between the 2048-byte DMA region and the 2112-byte SKB tailroom, skb_put() succeeds and hands up to 64 bytes of stale per-CPU page_frag memory (leftovers of previously received packets) to the network stack, where a bridging/forwarding deployment can transmit it back onto the wire. The read is hard-capped by skb->end and the IP stack trims it in most paths, so the disclosure is real but strictly bounded.\nI:N - The RDMA ring's DMA_RING_BUF_SIZE is programmed with RX_BUF_LENGTH, so the hardware never writes past the 2048-byte mapping \u2014 the bug is a bogus length report, not an out-of-bounds write. No kernel memory is corrupted and no control-flow or data-write primitive is obtained.\nA:H - Any reported length above 2112 drives skb_put() into skb_over_panic(), which calls BUG() from softirq context, taking the machine down immediately (the unmasked 16-bit shift permits lengths up to 65535, far past the limit). This is a full denial of service reachable from the network with no credentials."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "c34b1c0870323649d45c5074828d7f754dea2673", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "87363d1ab55e497702a9506ff423c422639c8a25", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "841881320562cbeac7046b537b91cd000480cea2", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce", "versionType": "git"}, {"status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.15"}, {"status": "unaffected", "version": "0", "lessThan": "3.15", "versionType": "semver"}, {"status": "unaffected", "version": "4.14.308", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.276", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.235", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.173", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.99", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.16", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2.3", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"}, {"url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"}, {"url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"}, {"url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"}, {"url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"}, {"url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"}, {"url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"}, {"url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.308", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.276", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.235", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.173", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.99", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.16", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2.3", "versionStartIncluding": "3.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3", "versionStartIncluding": "3.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:39.345Z"}}}, "cveMetadata": {"cveId": "CVE-2023-53535", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:30.176Z", "dateReserved": "2025-10-04T15:14:15.919Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-04T15:16:46.583Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "c34b1c0870323649d45c5074828d7f754dea2673", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "87363d1ab55e497702a9506ff423c422639c8a25", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "841881320562cbeac7046b537b91cd000480cea2", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}, {"lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd", "status": "affected", "version": "1c1008c793fa46703a2fee469f4235e1c7984333", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/genet/bcmgenet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.15"}, {"lessThan": "3.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.308", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.276", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.235", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.173", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.99", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.16", "versionType": "semver"}, {"lessThanOrEqual": "6.2.*", "status": "unaffected", "version": "6.2.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6529FA7-0DC2-41A2-AEE7-C43E9796C426", "versionEndExcluding": "4.14.308", "versionStartIncluding": "3.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C902FC54-DDBD-4DA6-BFEF-26889A267464", "versionEndExcluding": "4.19.276", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13DD5E68-8CB4-46EE-9A8F-C7F6C1A84430", "versionEndExcluding": "5.4.235", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D810CFB-B7C5-493C-B98A-0D5F0D8A47B6", "versionEndExcluding": "5.10.173", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B8B2AC9-2F31-4A0F-96F5-7E26B50B27BB", "versionEndExcluding": "5.15.99", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FD95FDA-6525-4B13-B3FB-49D9995FD8ED", "versionEndExcluding": "6.1.16", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B", "versionEndExcluding": "6.2.3", "versionStartIncluding": "6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."}], "id": "CVE-2023-53535", "lastModified": "2026-10-15T22:17:42.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-53535", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:35:28.502360Z", "version": "2.0.3"}}]}, "published": "2025-10-04T16:15:48.457", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: bcmgenet: Add a check for oversized packets", "id": "2401485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401485"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bcmgenet: Add a check for oversized packets\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."], "name": "CVE-2023-53535", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53535\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53535\nhttps://lore.kernel.org/linux-cve-announce/2025100442-CVE-2023-53535-c515@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:41:24.531421+00:00", "updated": "2025-10-06T14:41:24.531474+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}