{"id":"CVE-2023-53566","revision":"aeee17fca7de468d90cc1d79a633aa4c","records":[{"revision":"aeee17fca7de468d90cc1d79a633aa4c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-53566","aliases":[],"title":"netfilter: nft_set_rbtree: fix null deref on element insertion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: fix null deref on element insertion\n\nThere is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n nft_add_set_elem+0x14b0/0x2990\n  nf_tables_newsetelem+0x528/0xb30\n\nFurthermore, there is a possible use-after-free while iterating,\n'node' can be free'd so we need to cache the next value to use.","state":0,"publishedAt":"2025-10-04T15:17:08.598+00:00","modifiedAt":"2026-10-15T21:41:30.987+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nft_set_rbtree.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7ab87a326f20c52ff4d9972052d085be951c704b\",\n                            \"lessThan\": \"b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"181859bdfb9734aca449512fccaee4cacce64aed\",\n                            \"lessThan\": \"899aa5638568abf5d69de7a7bb95e4615157375b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4aacf3d78424293e318c616016865380b37b9cc5\",\n                            \"lessThan\": \"3fa13203b6d90cc3a33af47b058739f92ab82eef\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2bf1435fa19d2c58054391b3bba40d5510a5758c\",\n                            \"lessThan\": \"ec5caa765f7f6960011c919c9aeb1467940421f6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"318cb24a4c3fce8140afaf84e4d45fcb76fb280b\",\n                            \"lessThan\": \"a836be60a3aabcedcd9c79f545d409ace1f20ba6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9e6978e2725a7d4b6cd23b2facd3f11422c0643\",\n                            \"lessThan\": \"a337706c1fb35aac3f26b48aca80421bdbe1d33a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9e6978e2725a7d4b6cd23b2facd3f11422c0643\",\n                            \"lessThan\": \"61ae320a29b0540c16931816299eb86bf2b66c08\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.166\",\n                            \"lessThan\": \"5.10.181\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.91\",\n                            \"lessThan\": \"5.15.113\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.9\",\n                            \"lessThan\": \"6.1.30\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nft_set_rbtree.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.181\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.113\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.30\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.3.4\",\n                            \"lessThanOrEqual\": \"6.3.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.4\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56","https://git.kernel.org/stable/c/899aa5638568abf5d69de7a7bb95e4615157375b","https://git.kernel.org/stable/c/3fa13203b6d90cc3a33af47b058739f92ab82eef","https://git.kernel.org/stable/c/ec5caa765f7f6960011c919c9aeb1467940421f6","https://git.kernel.org/stable/c/a836be60a3aabcedcd9c79f545d409ace1f20ba6","https://git.kernel.org/stable/c/a337706c1fb35aac3f26b48aca80421bdbe1d33a","https://git.kernel.org/stable/c/61ae320a29b0540c16931816299eb86bf2b66c08"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53566","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-53566","identifiers":["CVE-2023-53566"]},"retained":false,"historicalAffected":[]}],"coverage":[]}