{"cve":"CVE-2023-53995","nvd":{"published":"2025-12-24T11:15:52.403","modified":"2026-06-17T06:46:30.293","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix one memleak in __inet_del_ifa()\n\nI got the below warning when do fuzzing test:\nunregister_netdevice: waiting for bond0 to become free. Usage count = 2\n\nIt can be repoduced via:\n\nip link add bond0 type bond\nsysctl -w net.ipv4.conf.bond0.promote_secondaries=1\nip addr add 4.117.174.103/0 scope 0x40 dev bond0\nip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0\nip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0\nip addr del 4.117.174.103/0 scope 0x40 dev bond0\nip link delete bond0 type bond\n\nIn this reproduction test case, an incorrect 'last_prim' is found in\n__inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40)\nis lost. The memory of the secondary address is leaked and the reference of\nin_device and net_device is leaked.\n\nFix this problem:\nLook for 'last_prim' starting at location of the deleted IP and inserting\nthe promoted IP into the location of 'last_prim'.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/2f1e86014d0cc084886c36a2d77bc620e2d42618","https://git.kernel.org/stable/c/42652af5360d30b43b06057c193739e7dfb18f42","https://git.kernel.org/stable/c/5624f26a3574500ce23929cb2c9976a0dec9920a","https://git.kernel.org/stable/c/7c8ddcdab1b900bed69cad6beef477fff116289e","https://git.kernel.org/stable/c/980f8445479814509a3cd55a8eabaae1c9030a4c"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2023-53995","score":0.00207,"percentile":0.10874,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}