CVE-2023-54035 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix underflow in chain reference counter
Set element addition error path decrements reference counter on chains twice: once on element release and again via nft_data_release().
Then, d6b478666ffa ("netfilter: nf_tables: fix underflow in object reference counter") incorrectly fixed this by removing the stateful object reference count decrement.
Restore the stateful object decrement as in b91d90368837 ("netfilter: nf_tables: fix leaking object reference count") and let nft_data_release() decrement the chain reference counter, so this is done only once.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/28/2025
The vulnerability identified as CVE-2023-54035 resides within the Linux kernel's netfilter subsystem, specifically within the nf_tables framework that manages packet filtering and manipulation rules. This issue represents a critical reference counting error that can lead to system instability and potential security implications. The vulnerability manifests in how the kernel handles chain reference counters during element addition operations, creating a scenario where reference counts become corrupted due to improper decrementing logic. The flaw affects systems utilizing the netfilter framework for network packet filtering, particularly those implementing nf_tables for rule management and packet classification. This vulnerability is classified under CWE-129 as an "Improper Validation of Array Index" and more specifically relates to improper reference counting mechanisms that can result in resource management issues.
The technical flaw occurs in the element addition error path where the reference counter for chains is decremented twice during cleanup operations. Initially, the reference counter is decremented when releasing the element, and then again through the nft_data_release() function. This double decrement was initially addressed in commit d6b478666ffa which incorrectly removed the stateful object reference count decrement, creating an underflow condition in the reference counting mechanism. The fix implemented in CVE-2023-54035 restores the proper decrement behavior that was previously established in commit b91d90368837, ensuring that the chain reference counter is properly decremented exactly once through the nft_data_release() function. This restoration maintains the integrity of the reference counting system and prevents potential resource leaks or system crashes that could occur from improper reference count management. The vulnerability operates at the kernel level and can be exploited through malicious packet filtering rule manipulation that triggers the faulty code path.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable denial of service conditions and resource exhaustion attacks. When the reference counting mechanism fails, it can lead to chains being freed prematurely or not freed at all, creating memory leaks that accumulate over time and eventually exhaust system resources. This behavior can be particularly dangerous in network infrastructure devices or servers that rely heavily on netfilter for traffic management and security enforcement. Attackers could potentially exploit this vulnerability by crafting specific packet filtering rules that trigger the error path during element addition operations, leading to system crashes or resource exhaustion. The vulnerability affects all Linux kernel versions that include the problematic nf_tables implementation and represents a significant risk to network security infrastructure that depends on proper reference counting for maintaining system stability.
Mitigation strategies for CVE-2023-54035 involve applying the appropriate kernel security patches that contain the corrected reference counting logic. System administrators should prioritize updating their kernel versions to include the fix from commit b91d90368837 and ensure that all network filtering rules are properly validated before deployment. Organizations should implement monitoring for unusual system behavior or resource consumption patterns that might indicate exploitation attempts. The fix addresses the underlying reference counting issue through proper restoration of decrement operations, ensuring that each chain reference is properly managed without double decrementing or underflow conditions. Additionally, implementing network segmentation and access controls around systems that utilize extensive netfilter rules can help limit the potential impact of exploitation attempts. The vulnerability's resolution aligns with ATT&CK technique T1059.006 for kernel-level exploitation and T1499.004 for resource exhaustion attacks, making proper patch management essential for maintaining system security posture.