High 7.0Published Oct 1, 2025

CVE-2023-53499virtio_net: Fix error unwinding of XDP initialization

Updated under an hour ago (Oct 27, 2026, 8:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open.

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	754b8a21a96d5f11712245aef907149606b323ae builds before 6a7690f2bd178eee80f33411ae32e543ae66379c; 754b8a21a96d5f11712245aef907149606b323ae builds before 73f53bc295727a3cdbd9d6bcdfaa239258970cf4; from 754b8a21a96d5f11712245aef907149606b323ae before 037768b28e3752c07d63d1c72a651a6775b080bb; from 754b8a21a96d5f11712245aef907149606b323ae before 5306623a9826aa7d63b32c6a3803c798a765474d	CNA record
linux linux_kernel linux:linux_kernel	from 4.16 before 5.15.113; from 5.16 before 6.1.30; from 6.2 before 6.3.4; 6.4; 6.4	NVD

References

References

https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379c	patch
https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4	patch
https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bb	patch
https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.