CVE-2023-53062: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53062 is a vulnerability discovered in the Linux kernel affecting the net/usb/smsc95xx component. The vulnerability was disclosed on May 2, 2025, and involves insufficient packet length validation in the SMSC95xx USB network driver (NVD, Wiz).

The vulnerability occurs when the packet length retrieved from the descriptor exceeds the actual socket buffer length. In such cases, the cloned socket buffer (skb) passed up the network stack can leak kernel memory contents. Red Hat has assigned a CVSS 3.1 score of 5.5 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat, Wiz).

The primary impact of this vulnerability is information disclosure, as it can lead to leakage of kernel memory contents through the network stack. This could potentially expose sensitive information to attackers (Wiz).

The vulnerability has been fixed in various Linux kernel versions. Debian has addressed this in multiple releases: bullseye (5.10.234-1), bookworm (6.1.135-1), trixie (6.12.22-1), and sid (6.12.25-1). Ubuntu has released fixes for versions 18.04, 20.04, and 22.04. Red Hat Enterprise Linux 9 has deferred the fix for both kernel and kernel-rt packages (Debian Tracker, Wiz).