NULL Pointer Dereference Affecting libperf package, versions <0:5.14.0-362.8.1.el9_3


Severity

Recommended
0.0
high
0
10

Based on CentOS security rating.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS9-LIBPERF-13338691
  • published7 Oct 2025
  • disclosed4 Oct 2025

Introduced: 4 Oct 2025

NewCVE-2023-53566  (opens in a new tab)
CWE-476  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Centos:9 libperf to version 0:5.14.0-362.8.1.el9_3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libperf package and not the libperf package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: fix null deref on element insertion

There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():

general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] nft_add_set_elem+0x14b0/0x2990 nf_tables_newsetelem+0x528/0xb30

Furthermore, there is a possible use-after-free while iterating, 'node' can be free'd so we need to cache the next value to use.

CVSS Base Scores

version 3.1