---
id: CVE-2023-1390
title: >-
  A remote denial of service vulnerability was found in the Linux kernel’s TIPC
  kernel module
summary: >-
  A remote denial of service vulnerability was found in the Linux kernel’s TIPC
  kernel module. The while loop in tipc_link_xmit() hits an unknown state while
  attempting to parse SKBs, which are not in the queue. Sending two small UDP
  packe…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-1050
product: Linux kernel (TIPC kernel module)
affected:
  - linux_kernel_tipc_kernel_module Fixed in kernel 5.11-rc4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-04-23T13:26:35.899836Z'
published: '2023-03-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:03:30.184Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-1390'
references:
  - url: 'https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5'
  - url: 'https://infosec.exchange/%40_mattata/109427999461122360'
  - url: >-
      https://github.com/torvalds/linux/commit/b77413446408fdd256599daf00d5be72b5f3e7c6
  - url: 'https://security.netapp.com/advisory/ntap-20230420-0001/'
tags:
  - cve.org
epss: 0.05095
epssPercentile: 0.91988
ingestedAt: '2026-09-18T15:44:31.588Z'
---

## Overview

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.

## Affected

- `linux_kernel_tipc_kernel_module Fixed in kernel 5.11-rc4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.