CVE-2023-52780

MEDIUMNVD 5.55.5

Also known asEUVD-2023-59497 (ENISA EUVD) · GHSA-h2gq-cg6c-vh9c (GitHub Security Advisories)Source: ENISA EUVD

5.5EG

EchelonGraph verdictMonitorRemediate within your standard update timelines (the SSVC decision on this page).

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 0.2%CVSS: 5.5Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

net: mvneta: fix calls to page_pool_get_stats

Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes. First the page pool is only available if the bm is not used. The page pool is also not allocated when the port is stopped. It can also be not allocated in case of errors.

The current implementation leads to the following crash calling ethstats on a port that is down or when calling it at the wrong moment:

ble to handle kernel NULL pointer dereference at virtual address 00000070 [00000070] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Hardware name: Marvell Armada 380/385 (Device Tree) PC is at page_pool_get_stats+0x18/0x1cc LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc : [] lr : [] psr: a0000013 sp : f1439d48 ip : f1439dc0 fp : 0000001d r10: 00000100 r9 : c4816b80 r8 : f0d75150 r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68 r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 066b004a DAC: 00000051 Register r0 information: NULL pointer Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r2 information: non-paged memory Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048 Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r5 information: NULL pointer Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096 Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 Register r9 information: slab task_struct start c4816b80 pointer offset 0 Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Process snmpd (pid: 733, stack limit = 0x38de3a88) Stack: (0xf1439d48 to 0xf143a000) 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000 page_pool_get_s ---truncated---

CVSS v3: 5.5
EG Score: 5.5MEDIUMmedium confidence
EG Risk: 25
EPSS PROB: 0.2%
EPSS %ILE: 14th
KEV: Not listed

What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)

The EG score (5.5): severity, escalated by confirmed exploitation. This CVE's 5.5 is its impact severity (EG Severity), not escalated.

EG Severity: 5.5 MEDIUMCVSS-B, impact only: no KEV listing, EPSS or EG-KEV tier raises it.GitHub Security Advisory CVSS
EG Likelihood: 0.2% within 30 daysSource: FIRST EPSS (model v2026.06.15, score date 2026-10-25). FIRST's exploitation probability, not an EchelonGraph model.
Confirmed exploitation: None on record (CISA KEV, EG-KEV Tier 1)Reported apart from the likelihood: an observed fact, not a probability.
EG Priority: SSVC Track at medium mission impactTrack at every mission impact level.CISA BOD 26-04: 60 days if the affected system is publicly exposed; Fix on system upgrade if it is not.Each input and its source, and whom BOD 26-04 binds: the SSVC and BOD 26-04 blocks below.

SSVC (CISA's decision table, applied by EchelonGraph)Track at every mission impact level.

A fix is available. Apply it within your standard update timelines.

Exploitation none (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). All three are CISA's SSVC values (Vulnrichment). EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE. Mission impact is CISA's Mission & Well-being decision point, and only you can judge it. CISA's table makes it high when Mission Prevalence is Essential — the vulnerable component "directly provides capabilities that constitute at least one MEF for at least one entity" (MEF: mission essential function) — or when Public Well-Being Impact is Irreversible: "multiple fatalities are likely", the cyber-physical system "is likely lost or destroyed", "extreme or serious externalities" are imposed on other parties, or social systems such as elections or the financial grid "are destabilized and potentially collapse". CISA's decision table

BOD 26-04 (CISA's remediation timeline, Table 1)60 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

The score's inputs: In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

May 21, 2024

Last Modified

February 3, 2025

References (4)

CVE Programhttps://git.kernel.org/stable/c/00768b3e90e648227eaa959d9d279f5e32823df1Patch
CVE Programhttps://git.kernel.org/stable/c/230dc06e2495487d88b3410da055bb618febb19bPatch
CVE Programhttps://git.kernel.org/stable/c/2b0e99072654edd601d05c0061a20337af5008baPatch
CVE Programhttps://git.kernel.org/stable/c/ca8add922f9c7f6e2e3c71039da8e0dcc64b87edPatch

Patch Availability(1)

Vendor / Ecosystem	Fix (by version range) / Patch	Released	Source
linux	Kernel @ 6.1.64 (fixes >=5.19.0)	—	osv

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(3 across 3 ecosystems)

Debian:12(1)

Package	Vulnerable range	Fix by version range	Dependents
linux	6.1.27-1 ... 6.1.55-1~bpo11+1 (11 versions)	every version up to 6.1.64-1: fixed in 6.1.64-1	—

Debian:13(1)

Package	Vulnerable range	Fix by version range	Dependents
linux	—	every version up to 6.6.8-1: fixed in 6.6.8-1	—

Debian:14(1)

Package	Vulnerable range	Fix by version range	Dependents
linux	—	every version up to 6.6.8-1: fixed in 6.6.8-1	—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

CWE-476NULL Pointer Dereference

Data Freshness Timeline

(refreshed 7× in last 7d / 37× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

Showing the most recent 92 of 197 refreshes on record for this CVE.

A repeat, a row identical to one the same pipeline wrote less than 10 seconds earlier, is not a separate refresh and is not counted. 8 repeat rows among the latest 100 are merged into the row they repeat. The 105 oldest rows on record are not shown and were not checked, so the counts can still include repeats.

2026-11-02 16:40 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-11-01 16:31 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-31 16:30 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-30 16:31 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-29 16:30 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-28 16:29 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-27 16:29 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-26 16:29 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-25 17:28 UTCEG score recompute
2026-10-25 16:30 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-10-24 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-24 11:41 UTCEG score recompute
2026-10-24 11:41 UTCGHSA enrichmentGHSA-h2gq-cg6c-vh9c · GitHub CVSS 5.5
2026-10-23 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-22 16:31 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-21 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-20 16:30 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-19 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-18 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-18 07:42 UTCEG score recompute
2026-10-17 16:30 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-16 16:36 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-15 16:29 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-14 16:30 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-13 16:30 UTCEPSS rescoreEPSS 0.2% · 13th percentile

Show 67 more

2026-10-12 18:13 UTCEG score recompute
2026-10-12 16:31 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-11 21:38 UTCEG score recompute
2026-10-11 13:45 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-10 23:52 UTCOSV refresh
2026-10-10 19:58 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-09 20:05 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-08 17:06 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-07 23:46 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-06 15:15 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-05 17:41 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-04 23:20 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-03 14:23 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-10-01 19:48 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-09-30 16:36 UTCEG score recompute
2026-09-30 15:01 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-09-29 15:17 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-09-28 13:49 UTCEPSS rescoreEPSS 0.2% · 13th percentile
2026-09-26 00:22 UTCEPSS rescoreEPSS 0.2% · 12th percentile
2026-09-24 14:01 UTCEPSS rescoreEPSS 0.2% · 12th percentile
2026-09-23 13:46 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-21 12:19 UTCOSV refresh
2026-09-20 20:14 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-18 19:26 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-16 14:06 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-16 05:11 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-15 03:08 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-13 16:45 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-12 14:58 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-11 14:51 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-11 09:34 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-08 21:58 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-07 15:59 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-06 13:46 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-05 15:26 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-04 13:58 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-04 05:04 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-02 14:10 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-02 09:44 UTCOSV refresh
2026-09-01 13:52 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-09-01 04:36 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-30 19:15 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-30 01:20 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-28 21:39 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-27 14:23 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-26 14:44 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-25 13:47 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-23 00:17 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-21 23:47 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-20 22:53 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-19 17:02 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-18 13:46 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-16 14:54 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-16 08:20 UTCOSV refresh
2026-08-16 02:12 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-13 21:58 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-12 13:49 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-11 13:40 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-10 23:58 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-09 13:44 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-08 16:35 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-07 16:25 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-06 13:45 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-05 19:15 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-04 10:36 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-03 10:34 UTCEPSS rescoreEPSS 0.2% · 14th percentile
2026-08-02 02:25 UTCEPSS rescoreEPSS 0.2% · 14th percentile

Same CWE

10 shown

CWE-476

Frequently asked(5)

What is CVE-2023-52780?

CVE-2023-52780 is a medium-severity vulnerability; its CVE record was published on May 21, 2024. In the Linux kernel, the following vulnerability has been resolved: net: mvneta: fix calls to page_pool_get_stats Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes. First the page pool is only available if the bm is not used. The page pool is also not allocated…

When was the CVE record for CVE-2023-52780 published?

The CVE record for CVE-2023-52780 was published on May 21, 2024. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of February 3, 2025; the record at its source may have been updated since.

Is CVE-2023-52780 actively exploited?

CVE-2023-52780 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.2% probability of exploitation in the next 30 days (14th percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2023-52780?

CVE-2023-52780 has a CVSS v3 base score of 5.5 (NVD).

How do I remediate CVE-2023-52780?

A fix for CVE-2023-52780 is available: update to the fixed version the vendor names in its advisory.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2023-52780

Explore →

Is Your Infrastructure Affected by CVE-2023-52780?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs

CVE-2023-52780

📅 Published

🔄 Last Modified

🔗 References (4)