net: deal with integer overflows in kmalloc_reserve()

Description

In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allowed various crash as reported by syzbot [1] and Kyle Zeng. Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32. kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0. kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations. Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE). This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng. [1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554 CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4 mm/kasan/report.c:398 kasan_report+0x150/0x1ac mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 __build_skb_around net/core/skbuff.c:294 [inline] __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 alloc_skb include/linux/skbuff.h:1316 [inline] igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359 add_grec+0x81c/0x1124 net/ipv4/igmp.c:534 igmpv3_send_cr net/ipv4/igmp.c:667 [inline] igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810 call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x54c/0x710 kernel/time/timer.c:1790 run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803 _stext+0x380/0xfbc ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq kernel/softirq.c:437 [inline] __irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683 irq_exit_rcu+0x14/0x78 kernel/softirq.c:695 el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Timeline

Scores

EPSS (exploitation in 30 days)

0.14% · top 96% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

• Linux · Linux

  • affected 0dbc898f5917c5a3bec6be19d9f5469cbc351a7d – < 31cf7853a940181593e4472fc56f46574123f9f6
  • affected 12d6c1d3a2ad0c199ec57c201cdc71e8e157a232 – < e4ffc47a1c3e5d11a853aa178c9a5136e79412e9
  • affected 12d6c1d3a2ad0c199ec57c201cdc71e8e157a232 – < bf7da02d2b8faf324206e1cbe64a4813ff903cc1
  • affected 12d6c1d3a2ad0c199ec57c201cdc71e8e157a232 – < 915d975b2ffa58a14bfcf16fafe00c41315949ff
  • affected 6.1.31 – < 6.1.54

• Linux · Linux

  • affected 6.2
  • unaffected < 6.2
  • unaffected 6.1.54 – ≤ 6.1.*
  • unaffected 6.4.16 – ≤ 6.4.*
  • unaffected 6.5.3 – ≤ 6.5.*
  • unaffected 6.6 – ≤ *

References (4)

• https://git.kernel.org/stable/c/31cf7853a940181593e4472fc56f46574123f9f6 (opens in a new tab)
• https://git.kernel.org/stable/c/e4ffc47a1c3e5d11a853aa178c9a5136e79412e9 (opens in a new tab)
• https://git.kernel.org/stable/c/bf7da02d2b8faf324206e1cbe64a4813ff903cc1 (opens in a new tab)
• https://git.kernel.org/stable/c/915d975b2ffa58a14bfcf16fafe00c41315949ff (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-53752](https://trackcve.app/badge/CVE-2023-53752.svg)](https://trackcve.app/cve/CVE-2023-53752)

Record last updated 5 Aug 2026, 09:15 UTC.