CVE-2023-53863: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53863 is a kernel information leak vulnerability in the Linux kernel's netlink subsystem, specifically in the forwarding database (FDB) dump functionality. The bug arises because the code hard-coded ETH_ALEN (6 bytes) as the device address length when copying data to user space, but some network devices have non-Ethernet address lengths (e.g., 4 bytes), causing uninitialized kernel memory to be leaked. It was published on December 9, 2025, and affects multiple stable Linux kernel versions. The CVSS category is estimated as Medium (Feedly, Vulners).

The root cause is an improper use of the hard-coded constant ETH_ALEN (6) instead of the device-specific dev->addr_len when performing FDB dumps via the netlink interface, classified as a kernel information disclosure (CWE-200/CWE-131 — incorrect calculation of buffer size). When a netdev device with an address length shorter than 6 bytes (e.g., 4 bytes) is present, the kernel copies 6 bytes to user space regardless, leaking up to 2 bytes of uninitialized kernel memory per FDB entry. The fix replaces ETH_ALEN with dev->addr_len in the relevant netlink FDB dump code path. The issue was originally identified by syzbot, which reported a KMSAN: kernel-infoleak in instrument_copy_to_user via the netlink_recvmsg → skb_copy_datagram_msg call chain (Feedly).

Successful exploitation allows a local user to read small amounts of uninitialized kernel memory (up to 2 bytes per FDB entry) via the netlink socket interface, constituting an information disclosure. While the leaked data volume is limited, such leaks can potentially be leveraged to defeat kernel ASLR or expose sensitive kernel data structures. Availability and integrity are not directly impacted by this vulnerability (Feedly).

The fix has been applied to multiple Linux kernel stable branches via commits to the kernel.org stable tree (e.g., commits 44db85c6, 61d1bf3c, 73862118, 61938431, aa540695). Users should update to a patched kernel version as provided by their Linux distribution. SUSE has issued advisories (SUSE-2026-0281-1, SUSE-2026-20876-1) incorporating the fix, and Tenable Nessus plugins (278013, 298924, 302405) are available for detection. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Feedly, Linux Security).