CVE-2023-52735

What it actually does

The vulnerability allows sock_map proto callbacks (close, destroy, unhash) to recursively invoke themselves, leading to unbounded stack growth and potential kernel stack overflow in the Linux BPF sockmap implementation.

Why it matters to the business

Unpatched systems risk kernel crashes or forced resource leaks under specific BPF networking workloads, potentially disrupting services on Linux hosts and increasing operational overhead for kernel stability in high-traffic environments; prevalence in the Linux ecosystem amplifies exposure across servers and embedded devices.

How an attack unfolds

An attacker crafts BPF programs or socket operations that trigger sock_map callbacks in a self-referential manner, causing the kernel to enter recursion until stack exhaustion occurs; the provided fix intercepts the loop to convert the crash into a controlled leak instead.

How to fix it

Upgrade the Linux kernel to version 5.15.95 or later, or apply the commit f312367f5246e04df564d341044286e9e37a97ba from the stable git repository; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel version matches or exceeds 5.15.95, confirm the sockmap callback protection logic is present in source, and test BPF sockmap workloads for absence of recursive self-calls or stack overflows.

Typical attack path

1. Identify or deploy a Linux environment using BPF sockmap for socket handling
2. Load a malicious or buggy BPF program that exercises sock_map close/destroy/unhash paths
3. Trigger repeated callback invocations to induce recursion
4. Cause kernel stack overflow resulting in panic or denial of service

How to detect it

Review kernel logs for stack overflow or recursion warnings involving sock_map functions; examine system crashes or oops reports tied to BPF socket operations; check for unexpected resource leaks in networking subsystems post-sockmap activity.

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within the next maintenance window due to high CVSS
• Monitor EPSS and threat intelligence for any increase in exploitation activity
• Audit custom BPF programs for sockmap usage and remove or isolate risky configurations until patched
• Test patched kernels in staging environments before broad deployment