CVE-2023-53549 – A denial-of-service vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2023-53549?

CVE-2023-53549 has a CVSS score of 5.5 (MEDIUM). A denial-of-service vulnerability in the Linux kernel's netfilter ipset subsystem allows attackers to cause soft lockups when adding or deleting large numbers of entries. This affects Linux systems using ipset for network filtering. The vulnerability can be triggered by any user with CAP_NET_ADMIN capabilities or root access.

📋 TL;DR

A denial-of-service vulnerability in the Linux kernel's netfilter ipset subsystem allows attackers to cause soft lockups when adding or deleting large numbers of entries. This affects Linux systems using ipset for network filtering. The vulnerability can be triggered by any user with CAP_NET_ADMIN capabilities or root access.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires ipset functionality to be enabled and used. Exploitation requires CAP_NET_ADMIN capabilities or root access.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes completely unresponsive due to kernel soft lockup, requiring hard reboot and causing extended service disruption.

🟠

Likely Case

Temporary system instability or performance degradation when processing large ipset operations, potentially affecting network filtering functionality.

🟢

If Mitigated

Minimal impact with proper access controls limiting who can modify ipsets and monitoring for abnormal ipset operations.

🌐 Internet-Facing: LOW - Requires local access or CAP_NET_ADMIN privileges to exploit.

🏢 Internal Only: MEDIUM - Internal users with appropriate privileges could cause denial of service affecting network filtering.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple command execution with appropriate privileges

Exploitation requires local access and appropriate privileges. The vulnerability is in the kernel's ipset implementation when processing large batch operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 24a828f5a54b, 5e29dc36bd5e, 8964cc36ba01, a1e1521b4639, ee756980e491

Vendor Advisory: https://git.kernel.org/stable/c/24a828f5a54bdeca0846526860d72b3766c5fe95

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Limit ipset batch operations

linux

Restrict the number of elements added/deleted in single ipset operations to prevent triggering the vulnerability

# Implement application-level limits when calling ipset commands
# Example: Split large ipset operations into smaller batches

Restrict CAP_NET_ADMIN capabilities

linux

Limit which users and processes have CAP_NET_ADMIN capability to reduce attack surface

# Use Linux capabilities to restrict access:
setcap -r /path/to/application
# Or use namespacing to isolate network capabilities

🧯 If You Can't Patch

Implement strict access controls to limit who can execute ipset commands
Monitor for abnormal ipset operations and implement rate limiting on ipset modifications

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from your distribution. Vulnerable if using unpatched kernel with ipset functionality.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched release from your distribution vendor and test ipset operations with large batches.

📡 Detection & Monitoring

Log Indicators:

Kernel messages containing 'soft lockup' or 'hung task' related to ipset operations
System logs showing repeated ipset add/delete operations with large element counts

Network Indicators:

Unusual patterns of ipset modifications
Network filtering rule changes in rapid succession

SIEM Query:

source="kernel" AND ("soft lockup" OR "hung task") AND "ipset"

📊 Metadata

CVE ID: CVE-2023-53549

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

EPSS Score: 0.02% exploit probability (3.9th percentile)

Published: October 4, 2025

Last Updated: February 10, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-53549, you might also want to check these: