CVE-2023-54265 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
Syzbot reported a bug as following:
===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline]
BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline]
BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline]
BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline]
arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline]
atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline]
__ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 ip6_finish_skb include/net/ipv6.h:1122 [inline]
ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline]
__do_sys_sendmsg net/socket.c:2568 [inline]
__se_sys_sendmsg net/socket.c:2566 [inline]
__x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline]
__alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline]
__ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline]
__do_sys_sendmsg net/socket.c:2568 [inline]
__se_sys_sendmsg net/socket.c:2566 [inline]
__x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug.
Use a local variable icmp6_type to carry the correct value in different scenarios.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability identified as CVE-2023-54265 resides within the Linux kernel's IPv6 networking stack, specifically in the __ip6_make_skb() function located in net/ipv6/ip6_output.c. This issue manifests as an uninitialized variable access bug that can be triggered through specific socket operations, particularly affecting raw IPv6 sockets. The bug was detected by Syzbot, a kernel fuzzer, and reported through KMSAN (Kernel Memory Sanitizer) which identified uninit-value access patterns during execution. The root cause occurs when processing ICMP6 headers that are not located within the linear region of the socket buffer, leading to improper memory access patterns.
The technical flaw stems from direct access to icmp6_hdr(skb)->icmp6_type without proper initialization checks, particularly in scenarios involving SOCK_RAW socket operations. When ICMP6 headers exist outside the main linear memory region of the socket buffer, the memory access pattern becomes problematic and leads to uninitialized variable usage. This vulnerability is classified under CWE-457: Use of Uninitialized Variable, which represents a fundamental programming error where variables are used before being properly initialized. The stack trace reveals the execution path leading to the issue through multiple kernel networking layers including rawv6_sendmsg, ip6_push_pending_frames, and ultimately __ip6_make_skb, where the uninitialized memory access occurs during atomic operations on 64-bit values.
The operational impact of this vulnerability extends to potential system instability and information disclosure risks when exploited. An attacker could potentially leverage this uninitialized memory access to cause kernel crashes or, in more sophisticated scenarios, extract sensitive information from kernel memory spaces. The vulnerability specifically affects systems running Linux kernels with IPv6 support and active raw socket usage, making it particularly relevant for network monitoring tools, security applications, and systems with complex networking configurations. The issue demonstrates a classic memory safety problem in kernel space where proper bounds checking and initialization protocols were not maintained during header processing operations.
Mitigation strategies for CVE-2023-54265 involve applying the official kernel patch that introduces a local variable icmp6_type to properly carry values in different scenarios, eliminating direct access to uninitialized memory regions. System administrators should prioritize updating their kernel versions to patched releases, particularly those addressing this specific memory access pattern in the IPv6 subsystem. The fix implements a defensive programming approach by ensuring proper variable initialization before memory access operations, aligning with ATT&CK technique T1068: Exploitation for Privilege Escalation, which emphasizes the importance of memory safety in kernel-level operations. Organizations should also implement monitoring for unusual network behavior or kernel panics that could indicate exploitation attempts, while maintaining current security practices for kernel security hardening and vulnerability management programs.