In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix table blob use-after-free

We are not allowed to return an error at this point.
Looking at the code it looks like ret is always 0 at this
point, but its not.

t = find_table_lock(net, repl->name, &ret, &ebt_mutex);

... this can return a valid table, with ret != 0.

This bug causes update of table->private with the new
blob, but then frees the blob right away in the caller.

Syzbot report:

BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74
Workqueue: netns cleanup_net
Call Trace:
kasan_report+0xbf/0x1f0 mm/kasan/report.c:517
__ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372
ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169
cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613
...

ip(6)tables appears to be ok (ret should be 0 at this point) but make
this more obvious.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00026.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c58dd2dd443c26d856a168db108a0cd11c285bf3 affected < 9060abce3305ab2354c892c09d5689df51486df5
c58dd2dd443c26d856a168db108a0cd11c285bf3 affected < dbb3cbbf03b3c52cb390fabec357f1e4638004f5
c58dd2dd443c26d856a168db108a0cd11c285bf3 affected < 3dd6ac973351308d4117eda32298a9f1d68764fd
c58dd2dd443c26d856a168db108a0cd11c285bf3 affected < cda0e0243bd3c04008fcd37a46b0269fb3c49249
c58dd2dd443c26d856a168db108a0cd11c285bf3 affected < e58a171d35e32e6e8c37cfe0e8a94406732a331f
a3bc0f8ea439762aa62d40a295157410498cbea7 affected —
8ed40c122919cd79bc3c059e5864e5e7d9d455f0 affected —
c5e4ef499cfc78de45a4f01b8c557b5964d77c53 affected —
f34728610b2a8c7b9864f9404f2884c17f6fca5c affected —
8b5740915a9faa8b1fa9166193a33e2a9ae30ec6 affected —
Linux Linux affected
Version Status Constraints
3.15 affected —
0 unaffected < 3.15
5.10.173 unaffected ≤ 5.10.*
5.15.100 unaffected ≤ 5.15.*
6.1.18 unaffected ≤ 6.1.*
6.2.5 unaffected ≤ 6.2.*
6.3 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3dd6ac973351308d4117eda32298a9f1d68764fd cve-icon cve-icon
https://git.kernel.org/stable/c/9060abce3305ab2354c892c09d5689df51486df5 cve-icon cve-icon
https://git.kernel.org/stable/c/cda0e0243bd3c04008fcd37a46b0269fb3c49249 cve-icon cve-icon
https://git.kernel.org/stable/c/dbb3cbbf03b3c52cb390fabec357f1e4638004f5 cve-icon cve-icon
https://git.kernel.org/stable/c/e58a171d35e32e6e8c37cfe0e8a94406732a331f cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123034-CVE-2023-54243-5fb8@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54243 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54243 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 30 Dec 2025 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
Title netfilter: ebtables: fix table blob use-after-free
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-30T12:11:31.180Z

Reserved: 2025-12-30T12:06:44.510Z

Link: CVE-2023-54243

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:16:12.880

Modified: 2025-12-31T20:42:43.210

Link: CVE-2023-54243

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2023-54243 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.