CVE-2023-52698

What it actually does

Memory leak in netlbl_calipso_add_pass() when IPv6 is disabled at boot; netlbl_calipso_ops_get() returns NULL so allocated doi_def structures are never freed via calipso_doi_free().

Why it matters to the business

Repeated triggering by local processes slowly exhausts kernel memory, eventually causing system instability, crashes, or denial of service on affected Linux systems; high prevalence of the kernel increases exposure across servers and devices.

How an attack unfolds

An attacker with local access sends crafted netlink messages that reach netlbl_calipso_add while IPv6 is disabled, causing repeated allocations without corresponding frees; over time this depletes memory and can lead to crashes. No named threat actors are known to exploit this specific issue.

How to fix it

Upgrade the Linux kernel to the fixed commit 9a8f811a146aa2a0230f8edb2e9f4b6609aab8da or later stable releases that include the patch; rebuild and reboot systems with the updated kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 9a8f811a146aa2a0230f8edb2e9f4b6609aab8da; attempt to reproduce the syzkaller reproducer under ipv6.disable=1 and verify no new unreferenced calipso objects appear in kmemleak or slabinfo.

Typical attack path

1. Obtain local code execution or shell access on a Linux system booted with ipv6.disable=1
2. Invoke netlabel netlink commands that call netlbl_calipso_add_pass()
3. Repeat the operation to accumulate unreferenced kernel allocations
4. Monitor until memory pressure triggers OOM killer or system instability

How to detect it

Inspect kernel logs for repeated netlbl_calipso_add entries, monitor slabinfo or kmemleak reports for unreferenced objects allocated from net/netlabel/netlabel_calipso.c, and review netlink audit records for genl_family_rcv_msg activity targeting the calipso family.

• netlbl_calipso_add_pass
• unreferenced object.*net/netlabel/netlabel_calipso.c
• kmalloc.*netlbl_calipso_add

What your security team should do

• Prioritize patching all systems that may boot with ipv6.disable=1 within the next maintenance window
• Add kernel version checks to asset inventory to identify unpatched hosts
• Monitor for memory-leak indicators in production workloads that use netlabel
• Consider disabling netlabel functionality if not required to reduce attack surface