CVE-2023-53304

What it actually does

The lazy GC on insert fails to release the other half of timed-out intervals in nft_set_rbtree; incorrect use of rbe_prev versus prev pointer and missing genmask checks on end intervals allow stale elements to persist, causing memory leaks or corruption.

Why it matters to the business

Vulnerable Linux systems risk kernel memory exhaustion, instability, or local privilege escalation, affecting network filtering, container workloads, and overall host availability; high ecosystem prevalence in Linux distributions increases exposure for servers and appliances.

How an attack unfolds

A local attacker loads crafted nftables rulesets containing overlapping intervals to trigger the faulty expiration walk and pointer logic during set insertion, leaving dangling elements that can be leveraged for memory corruption or information leaks.

How to fix it

Upgrade the Linux kernel to version 5.10.190 or apply the fix from commit 8284a79136c384059e85e278da2210b809730287; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version is at or above 5.10.190; run the nftables testcase sets/0044interval_overlap_0 with kmemleak enabled and verify no leaks or crashes occur.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux host
2. Load or modify nftables configuration with overlapping interval sets
3. Trigger set insertion to invoke the broken lazy GC and rbe_prev logic
4. Reuse resulting stale kernel memory objects for corruption or escalation

How to detect it

Review kernel logs and nftables audit events for repeated interval set insertions; inspect for unexpected growth in netfilter memory structures or kmemleak reports referencing rbtree elements.

What your security team should do

• Apply kernel updates immediately on internet-facing or multi-tenant systems
• Audit nftables usage and restrict unprivileged rule loading where possible
• Monitor EPSS and threat actor activity for any rise in exploitation attempts