CVE-2023-52340 is a high severity (7.5) denial of service in the IPv6 code of the Linux kernel before 6.3. The route table limit can be used up quickly, and IPv6 sends then fail. Fix it by running kernel 6.3 or later, or a distribution kernel with the backport, and reboot.
What's affected
NVD lists the Linux kernel before 6.3. The upstream change is commit af6d10345ca7, titled "ipv6: remove max_size check inline with ipv4", which went into the 6.3 series. Distribution kernels carry the fix as a backport, so the base version number is not enough on its own.
Debian LTS announced DLA-3841-1 on 25 June 2024. It lists CVE-2023-52340 among the issues fixed in linux-5.10 version 5.10.209-2~deb10u1 for Debian 10 buster. Other distributions publish their own package versions, so look at your vendor tracker.
Weakness class: CWE-400.
Vector note. The NVD vector is network based, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The commit message demonstrates the problem with a local program sending IPv6 packets in a loop through a raw socket. I did not find an advisory that settles how reachable it is from a remote peer, so read both before you rank it.
How to check if you're exposed
Read the running kernel and compare it with your distribution advisory.
uname -r
On Debian or Ubuntu, apt changelog linux-image-$(uname -r) shows whether the CVE id appears in the package changelog. On Red Hat family systems use rpm -q --changelog kernel | grep CVE-2023-52340.
A symptom of the underlying condition is the kernel message "Route cache is full: consider increasing sysctl net.ipv6.route.max_size", followed by network unreachable errors on sends. That points to the issue, but a missing message does not prove you are patched.
What to do now
- Install the kernel update your distribution ships for this CVE and reboot into it.
- Where you run kernels older than 6.3 from a vendor, check the vendor tracker for the fixed package version.
- For container hosts, patch the host kernel. Containers share it and cannot update it themselves.
- Alert on the "Route cache is full" message while you roll out the fix.
Why it matters
The commit message explains the cause. Sending IPv6 packets in a loop through a raw socket makes the kernel clone a route for each packet, and that quickly uses up the IPv6 max_size threshold, which defaults to 4096. When it is full the packet is dropped and sendto() returns a network unreachable error.
The fix follows a suggestion in the commit to drop the max_size check, since IPv6 already has a garbage collector to manage memory and IPv4 does not check max_size. The class is resource exhaustion. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which kernel version fixes it?
Upstream, the fix is in 6.3. Distribution kernels backport it under their own version numbers, for example Debian 10 linux-5.10 5.10.209-2~deb10u1 per DLA-3841-1.
Do I need a reboot?
Yes. A kernel package update takes effect only after you boot into the new kernel, unless you use a live patching service from your vendor.
Sources
Last reviewed: 19 October 2026.
