CVE-2023-53995

What it actually does

Incorrect 'last_prim' selection in __inet_del_ifa() causes secondary IPv4 addresses to be lost on deletion when promote_secondaries is enabled, leaking the address memory plus references to in_device and net_device.

Why it matters to the business

Bonded interfaces with IPv4 secondary address promotion can leak memory and delay device cleanup, leading to gradual resource exhaustion and potential hangs during interface teardown on affected systems.

How an attack unfolds

An attacker with local network configuration rights creates a bond interface, enables promote_secondaries, adds a mix of primary and secondary addresses, deletes one address, then removes the bond to trigger the reference leak.

How to fix it

Apply the upstream fix that searches for last_prim starting at the deleted IP location before promotion. Update affected packages to the listed fixed Git commits where applicable.

How to confirm the fix worked

Confirm the patch is present by inspecting __inet_del_ifa() logic for last_prim search starting at the deleted address; reproduce the provided reproduction steps and verify no usage-count warning appears on bond deletion.

Typical attack path

1. Create bond interface
2. Set net.ipv4.conf.<bond>.promote_secondaries=1
3. Add primary and secondary IPv4 addresses
4. Delete one of the primary addresses
5. Delete the bond interface

How to detect it

Search kernel logs for unregister_netdevice warnings showing usage count greater than one after bond deletion; correlate with prior ip addr add/del operations on interfaces having promote_secondaries enabled.

• unregister_netdevice: waiting for .* to become free. Usage count = 2

What your security team should do

• Prioritize patching systems that use network bonding with promote_secondaries
• Review and restrict local privileges required for interface and sysctl changes
• Monitor kernel logs for unregister_netdevice usage-count warnings