CVE-2023-53660

An incorrect object type handling flaw was found in the Linux kernel's BPF cpumap implementation in the cleanup path. A local user can trigger this issue by running XDP redirect operations in SKB mode with the cpumap, causing the cleanup code to incorrectly treat socket buffers as XDP frames when freeing ptr_ring contents. This results in memory corruption and kernel warnings, leading to denial of service through system instability or crash.

The cpumap is used for XDP (eXpress Data Path) packet processing and can operate in either native XDP frame mode or SKB (socket buffer) mode. When operating in SKB mode, the ptr_ring contains skb pointers rather than XDP frame pointers. However, the __cpu_map_ring_cleanup function assumes all entries are XDP frames and attempts to free them using xdp_return_frame, which causes type confusion when it encounters skbs. This triggers warnings about incorrect XDP memory types and can cause crashes. The issue manifests when running xdp_redirect_cpu in skb-mode, particularly under stress conditions that cause the kthread to stop prematurely. Triggering requires local access and the ability to load and run XDP programs, which typically requires elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.