CVE-2023-52654

Status: ModifiedMedium (4.7)—PoC

Severity4.7Medium · CVSS 3.1

Exploitation probability0.89 %higher than 59% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailableProof of concept on GitHub (unverified)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/af_unix: disable sending io_uring over sockets

File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.

CVSS

Base score: 4.7
Version: 3.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.89 %
Percentile among all scored CVEs: 59
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Linux — Linux Kernel

CWEs

NVD-CWE-noinfo

References

Show 12 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2023-52654",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52654",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-09T18:37:06.033789Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "04df9719df1865f6770af9bc7880874af0e594b2",
              "lessThan": "18824f592aad4124d79751bbc1500ea86ac3ff29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c378c479c5175833bb22ff71974cda47d7b05401",
              "lessThan": "3fe1ea5f921bf5b71cbfdc4469fb96c05936610e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
              "lessThan": "bcedd497b3b4a0be56f3adf7c7542720eced0792",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "lessThan": "f2f57f51b53be153a522300454ddb3887722fb2c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "lessThan": "5a33d385eb36991a91e3dddb189d8679e2aac2be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "lessThan": "705318a99a138c29a512a72c3e0043b3cd7f55f4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4293c01ee0d0ecdd3cb5801e13f62271144667a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75e94c7e8859e58aadc15a98cc9704edff47d4f2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.220",
              "lessThan": "5.4.264",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.10.150",
              "lessThan": "5.10.204",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.75",
              "lessThan": "5.15.143",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.19.17",
              "lessThan": "5.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.3",
              "lessThan": "6.1",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "io_uring/rsrc.h",
            "net/core/scm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.264",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.204",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.143",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.68",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.7",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "io_uring/rsrc.h",
            "net/core/scm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-05-14T14:23:13.130",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2c",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/af_unix: disable sending io_uring over sockets\n\nFile reference cycles have caused lots of problems for io_uring\nin the past, and it still doesn't work exactly right and races with\nunix_stream_read_generic(). The safest fix would be to completely\ndisallow sending io_uring files via sockets via SCM_RIGHT, so there\nare no possible cycles invloving registered files and thus rendering\nSCM accounting on the io_uring side unnecessary."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: io_uring/af_unix: deshabilita el envío de io_uring a través de sockets Los ciclos de referencia de archivos han causado muchos problemas para io_uring en el pasado, y todavía no funciona exactamente correctamente y corre con unix_stream_read_generic(). La solución más segura sería no permitir por completo el envío de archivos io_uring a través de sockets a través de SCM_RIGHT, de modo que no haya ciclos posibles que involucren archivos registrados y, por lo tanto, hagan innecesaria la contabilidad SCM en el lado io_uring."
    }
  ],
  "lastModified": "2026-08-04T10:18:36.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E2C4C68-2F88-4106-AD66-FA8891A907E3",
              "versionEndExcluding": "5.4.264",
              "versionStartIncluding": "5.4.220"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "576AA0C2-EAA1-48A0-ABBF-A2B91887A533",
              "versionEndExcluding": "5.10.204",
              "versionStartIncluding": "5.10.150"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD6CB4C0-2F8D-4BED-9163-932088CD13D1",
              "versionEndExcluding": "5.15.143",
              "versionStartIncluding": "5.15.75"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79FE0F04-9BE6-40F3-AA03-5DE7796C34A7",
              "versionEndExcluding": "5.20",
              "versionStartIncluding": "5.19.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C18ACF08-BC01-4909-A899-7B8AE346ECA6",
              "versionEndExcluding": "6.1.68",
              "versionStartIncluding": "6.0.3"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38CB764D-606E-4695-8437-DD35E0B1A6FC",
              "versionEndExcluding": "6.6.7",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A0038DE-E183-4958-A6E3-CE3821FEAFBF"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E31AD4FC-436C-44AB-BCAB-3A0B37F69EE0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C56C6E04-4F04-44A3-8DB8-93899903CFCF"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C78EDA4-8BE6-42FC-9512-49032D525A55"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}