---
id: CVE-2023-52997
title: 'ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: prevent potential spectre v1 gadget in ip_metrics_convert()\n\nif (!type)\n\t\tcontinue;\n\tif (type > RTAX_MAX)\n\t\treturn -EINVAL;\n\t...\n\tmetrics[type - 1] = val;\n\n@type …"
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    ef050cf5fb70d995a0d03244e25179b7c66a924a
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    746db9ec1e672eee13965625ddac0d97e16fa20c
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    34c6142f0df9cd75cba5a7aa9df0960d2854b415
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    d50e7348b44f1e046121ff5be01b7fb6978a1149
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    6850fe301d015a7d2012d1de8caf43dafb7cc2f6
  - >-
    Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 <
    1d1d63b612801b3f0a39b7d4467cad0abd60e5c8
  - Linux 4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:14:16.390465Z'
published: '2025-03-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:20:53.777Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-52997'
references:
  - url: 'https://git.kernel.org/stable/c/ef050cf5fb70d995a0d03244e25179b7c66a924a'
  - url: 'https://git.kernel.org/stable/c/746db9ec1e672eee13965625ddac0d97e16fa20c'
  - url: 'https://git.kernel.org/stable/c/34c6142f0df9cd75cba5a7aa9df0960d2854b415'
  - url: 'https://git.kernel.org/stable/c/d50e7348b44f1e046121ff5be01b7fb6978a1149'
  - url: 'https://git.kernel.org/stable/c/6850fe301d015a7d2012d1de8caf43dafb7cc2f6'
  - url: 'https://git.kernel.org/stable/c/1d1d63b612801b3f0a39b7d4467cad0abd60e5c8'
tags:
  - cve.org
epss: 0.00269
epssPercentile: 0.19246
ingestedAt: '2026-11-05T22:38:31.756Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

if (!type)
		continue;
	if (type > RTAX_MAX)
		return -EINVAL;
	...
	metrics[type - 1] = val;

@type being used as an array index, we need to prevent
cpu speculation or risk leaking kernel memory content.

## Affected

- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < ef050cf5fb70d995a0d03244e25179b7c66a924a`
- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < 746db9ec1e672eee13965625ddac0d97e16fa20c`
- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < 34c6142f0df9cd75cba5a7aa9df0960d2854b415`
- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < d50e7348b44f1e046121ff5be01b7fb6978a1149`
- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < 6850fe301d015a7d2012d1de8caf43dafb7cc2f6`
- `Linux >= 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 < 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8`
- `Linux 4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.