ZeroDay Findings
Sign inSign up

Findings

CVE-2023-3389

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.

Published Jun 28, 2023 · updated Oct 14, 2026 · linux linux kernel

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).

Timeline

Detection, updates, and resolution for this record.

  1. Jun 28, 2023 · NIST NVD

    Detected

    A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5

  2. Oct 14, 2026 · NIST NVD

    Updated

    A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5

Affected

  • cpe canonical/ubuntu linux14.04
  • cpe canonical/ubuntu linux16.04
  • cpe canonical/ubuntu linux18.04
  • cpe canonical/ubuntu linux20.04
  • cpe canonical/ubuntu linux22.04
  • cpe debian/debian linux10.0
  • cpe linux/linux kernelversion unspecified

Sources

  • CVE.orgCVE-2023-3389

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-3389

    30-day exploitation probability 0.7%

    first.org
  • NIST NVDCVE-2023-3389

    A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References