High severity7.8NVD Advisory· Published Sep 6, 2023· Updated Jun 17, 2026
CVE-2023-4207
CVE-2023-4207
Description
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.
When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
29- osv-coords25 versionspkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/perfpkg:rpm/almalinux/python3-perf
< 4.18.0-513.5.1.el8_9+ 24 more
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
- (no CPE)range: < 4.18.0-513.5.1.el8_9
Patches
Vulnerability mechanics
References
4- git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/nvdIssue TrackingMailing ListPatchVendor Advisory
- kernel.dance/76e42ae831991c828cffa8c37736ebfb831ad5ecnvdPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlnvdMailing ListThird Party AdvisoryVDB Entry
- www.debian.org/security/2023/dsa-5492nvdThird Party Advisory
News mentions
0No linked articles in our index yet.