ipv6/addrconf: fix a potential refcount underflow for idev
In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.40, 6.4.5
- CVEs
- CVE-2023-53189
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 19:49 UTC · Revision 1
Source evidence
ipv6/addrconf: fix a potential refcount underflow for idev
core-osv · Original sourcePublished 15 Sept 2025, 14:05 UTC
In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.
osv:CVE-2023-53189
Kernel
Fixed versions: 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5
Complete source record
{
"id": "758d6dc578a0706f4f15d2b28f391438f54e28f3c8d7fe28b5b84303a0f33ec6",
"url": "https://osv.dev/vulnerability/CVE-2023-53189",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ipv6/addrconf: fix a potential refcount underflow for idev",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0.",
"evidence": "osv:CVE-2023-53189",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.14.322",
"evidence": "/affected/1/ranges"
},
{
"value": "4.19.291",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.251",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.188",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.121",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.40",
"evidence": "/affected/1/ranges"
},
{
"value": "6.4.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2023-53189",
"aliases": [
"CVE-2023-53189"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b7b1bfce0bb68bd8f6e62a28295922785cc63781"
},
{
"fixed": "c6395e32935d35e6f935e7caf1c2dac5a95943b4"
},
{
"fixed": "df62fdcd004afa72ecbed0e862ebb983acd3aa57"
},
{
"fixed": "c7eeba47058532f6077d6a658e38b6698f6ae71a"
},
{
"fixed": "2ad31ce40e8182860b631e37209e93e543790b7c"
},
{
"fixed": "82abd1c37d3bf2a2658b34772c17a25a6f9cca42"
},
{
"fixed": "436b7cc7eae7851c184b671ed7a4a64c750b86f7"
},
{
"fixed": "1f656e483eb4733d62f18dfb206a49b78f60f495"
},
{
"fixed": "06a0716949c22e2aefb648526580671197151acc"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.10.105"
},
{
"fixed": "3.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "973d5956f754cfc306f5e274d71503498f4b0324"
}
]
}
],
"versions": [
"v3.10.108",
"v3.10.107",
"v3.10.106",
"v3.10.105"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53189.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11.0"
},
{
"fixed": "4.14.322"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "4.19.291"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.251"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.188"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.121"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.40"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.4.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53189.json"
}
}
],
"modified": "2026-10-28T02:30:23.178358312Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/06a0716949c22e2aefb648526580671197151acc",
"https://git.kernel.org/stable/c/1f656e483eb4733d62f18dfb206a49b78f60f495",
"https://git.kernel.org/stable/c/2ad31ce40e8182860b631e37209e93e543790b7c",
"https://git.kernel.org/stable/c/436b7cc7eae7851c184b671ed7a4a64c750b86f7",
"https://git.kernel.org/stable/c/82abd1c37d3bf2a2658b34772c17a25a6f9cca42",
"https://git.kernel.org/stable/c/c6395e32935d35e6f935e7caf1c2dac5a95943b4",
"https://git.kernel.org/stable/c/c7eeba47058532f6077d6a658e38b6698f6ae71a",
"https://git.kernel.org/stable/c/df62fdcd004afa72ecbed0e862ebb983acd3aa57",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53189.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-53189",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53189.json"
}
},
"related_cves": [
{
"value": "CVE-2023-53189",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489388,
"published_at": "2025-09-15T14:05:26.685+00:00"
}