ZeroDay Findings
Sign inSign up

Findings

CVE-2023-3611

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

Published Jul 21, 2023 · updated Oct 14, 2026 · Linux Kernel

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 21, 2023 · NIST NVD

    Detected

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Affected

  • cpe debian/debian linux10.0
  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel6.5
  • vendor Linux Kernelversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2023-3611

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes wit

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2023-3611

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-3611

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2023-3611

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes wi

    nvd.nist.gov

References