CVE-2023-53304: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53304 affects the Linux kernel's netfilter component, specifically in the nftsetrbtree functionality. The vulnerability was disclosed and published to the CVE List on September 16, 2025. The issue involves a bug in the lazy garbage collection process during insert operations that fails to properly release timed-out entries in interval overlaps (NVD).

The vulnerability exists in the netfilter's nftsetrbtree implementation where two specific issues were identified: First, the lazy garbage collection on insert fails to release the other half of the interval when timed-out entries are present. Second, there is an incorrect use of rbeprev versus prev pointer - when rbeprev() returns NULL after at least one iteration, rbeprev points to an element that is not an end interval and should not be removed. The issue can be reproduced using tests/shell/testcases/sets/0044intervaloverlap_0 in nftables.git with kmemleak enabled kernel (NVD).