Executive brief
A flaw in the Linux kernel's TCP networking code can cause crashes when transmitting large network packets using zero-copy techniques with huge pages. Systems using BIG TCP features to send packets larger than 68 KB are vulnerable to kernel panics, resulting in service interruption or denial of service.
Technical details
The vulnerability exists in the skb_copy_ubufs() function in net/core/skbuff.c. The function incorrectly assumed it could copy all socket buffer payload using up to MAX_SKB_FRAGS order-0 pages (typically 16–45 KB limit). However, when BIG TCP was enabled to allow GSO packets up to 512 KB, this assumption broke and caused buffer overflows or memory corruption. The vulnerability triggers when TCP TX zero-copy uses hugepages and skb length exceeds approximately 68 KB. The fix involves dynamically computing the required page order and using higher-order pages (alloc_pages with appropriate order) instead of single-order pages. A patch was released to allocate pages with __GFP_COMP flag to prevent memory leaks.
Affected products
- Linux Linux kernel Multiple kernel versions affected; patch commit 7e692df3933628d974acb9f5b334d2b3e885e2a6 dated 2023-04-28
Timeline
- 2023-04-28: disclosed: Upstream patch commit 7e692df3933628d974acb9f5b334d2b3e885e2a6
- 2023-04-28: patched: Fix released by Eric Dumazet
- 2025-10-07: advisory: CVE-2023-53669 published