In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table). Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0af8c09c896810879387decfba8c942994bb61f5 cve-icon cve-icon
https://git.kernel.org/stable/c/3cc9610a87b7dde82f7360dd4eb6c2c27940ed57 cve-icon cve-icon
https://git.kernel.org/stable/c/512b6c4b83c91d007301ea7d7f095d16c3aceacd cve-icon cve-icon
https://git.kernel.org/stable/c/e306dbee4c98025a9326386023a12ef4d887e9d1 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025091509-CVE-2023-53200-a0c8@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53200 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53200 cve-icon
History

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Tue, 16 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 15 Sep 2025 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table). Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak.
Title netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-15T14:21:28.466Z

Updated: 2025-09-15T14:21:28.466Z

Reserved: 2025-09-15T13:59:19.067Z

Link: CVE-2023-53200

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-15T15:15:46.400

Modified: 2025-09-15T15:22:27.090

Link: CVE-2023-53200

cve-icon Redhat

Severity : Important

Publid Date: 2025-09-15T00:00:00Z

Links: CVE-2023-53200 - Bugzilla