CVE-2023-3609
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.
Published Jul 21, 2023 · updated Oct 14, 2026 · linux linux kernel
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jul 21, 2023 · NIST NVD
Detected
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be f
Oct 14, 2026 · NIST NVD
Updated
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be f
Affected
- cpe debian/debian linux10.0
- cpe linux/linux kernelversion unspecified
- cpe linux/linux kernel6.4
Sources
- CVE.orgVulnerability recordCVE-2023-3609
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2023-3609
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2023-3609
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in t
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
Packet Storm link already published on the finding.
packetstormsecurity.com