CVE-2023-53477: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53477 is a denial-of-service vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the rt6_nlmsg_size() function's nexthop buffer size calculation. When a fib6_info entry lacks an lwtunnel (lightweight tunnel) encapsulation but its sibling routes contain lwtunnels, the function underestimates the required buffer size, triggering a kernel warning in inet6_rt_notify(). The vulnerability affects Linux kernel versions 4.11 through 5.4.234, 5.5 through 5.10.172, 5.11 through 5.15.99, 5.16 through 6.1.17, and 6.2 through 6.2.4. It was published on October 1, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect buffer size calculation (CWE-131: Incorrect Calculation of Buffer Size) in rt6_nlmsg_size() within the Linux kernel's IPv6 route notification path. The function calculates nexthop message length by multiplying the nexthop length of the primary fib6_info by the number of siblings — but if the primary entry has no lwtunnel while sibling routes do carry lwtunnel encapsulations, the resulting size is too small. This triggers a WARN_ON assertion in inet6_rt_notify() at net/ipv6/route.c:6180 when the kernel attempts to send a netlink route notification. The fix iterates over all siblings using rt6_nh_nlmsg_size() to correctly accumulate each sibling's encapsulation size. The vulnerability is locally exploitable by a low-privileged user with access to IPv6 route configuration commands, and can be reproduced by creating multiple IPVLAN interfaces with mixed encapsulated and non-encapsulated IPv6 routes (Red Hat Bugzilla).

Successful exploitation causes a denial-of-service condition, manifesting as kernel warnings and potential route configuration failures or system instability during IPv6 route operations. The impact is limited to availability (no confidentiality or integrity impact), affecting systems that use IPv6 multipath routing with lwtunnel encapsulations across virtual network interfaces such as IPVLAN. In environments relying on IPv6 routing for network connectivity, repeated triggering could destabilize the networking stack (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., ability to run ip route commands) and is not remotely exploitable. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.024%, reflecting very low probability of exploitation in the near term (Red Hat Advisory).

Update the Linux kernel to a patched version based on your current kernel series: 5.4.235+, 5.10.173+, 5.15.100+, 6.1.18+, or 6.2.5+. Patches are available in the Linux kernel stable tree repositories at git.kernel.org. If immediate patching is not feasible, restrict local user access to IPv6 route configuration commands (e.g., via ip tool permissions or network namespace isolation) to reduce exposure (Red Hat Bugzilla, git.kernel.org).