CVE-2023-53987: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53987 is a NULL pointer dereference vulnerability in the Linux kernel's ping socket implementation, specifically affecting the /proc/net/icmp interface. The flaw was introduced after commit dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock"), which switched ping sockets to RCU-based locking but failed to retain spinlock protection for the /proc/net/icmp procfs path. Affected Linux kernel versions span from the introduction of commit dbca1596bbb0 up to (but not including) the fix commits targeting stable branches 6.1.x and 6.2.x, with patches landing in versions 6.1.24 and 6.2.11, and mainline 6.3. The CVE was published on December 24, 2025, and carries an estimated CVSS severity of Medium with no official NVD score assigned at this time (Red Hat CVE, EUVD).

The root cause is a NULL pointer dereference (CWE-476) arising from an incorrect locking strategy in the Linux kernel's ping subsystem. After the RCU conversion of ping sockets (commit dbca1596bbb0), the /proc/net/icmp read path was left without adequate synchronization — specifically, it should use a spinlock rather than RCU to safely traverse the ping socket hash list. Without the spinlock, a concurrent modification to the socket list during a /proc/net/icmp read can result in a NULL pointer dereference. The fix reverts the /proc/net/icmp path to spinlock-based locking and also converts ping sockets from hlist_nulls to hlist, which is safe because ping sockets do not use SLAB_TYPESAFE_BY_RCU (Red Hat CVE, kernel.org patch 1, kernel.org patch 2).

Successful exploitation of this vulnerability can cause a kernel NULL pointer dereference, leading to a system crash (kernel panic) and denial of service. The impact is primarily an availability concern — an attacker or unprivileged local user capable of triggering concurrent access to /proc/net/icmp while ping socket state is being modified could crash the affected system. There is no known confidentiality or integrity impact, and the vulnerability does not provide a direct path to privilege escalation or remote code execution based on available information (Red Hat CVE).

The fix is included in Linux kernel stable releases 6.1.24, 6.2.11, and mainline 6.3. Three upstream patch commits address the issue: 176cbb6da28f, 5a08a32e6249, and ab5fb73ffa01. Users running affected kernel versions should upgrade to 6.1.24, 6.2.11, or later. Distribution-specific kernel updates from vendors such as Red Hat should be applied as they become available (Red Hat CVE, kernel.org patch 1).