{"id":"CVE-2023-3609","revision":"6850d0cbbd254d4a8bad9ce3bd41863f","records":[{"revision":"6850d0cbbd254d4a8bad9ce3bd41863f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-3609","aliases":[],"title":"Use-after-free in Linux kernel's net/sched: cls_u32 component","description":"A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.\n\n\n\nIf tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.\n\n\n\nWe recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.","state":0,"publishedAt":"2023-07-21T20:47:12.172+00:00","modifiedAt":"2026-10-14T20:55:31.437+00:00","affected":[{"ecosystem":"Vendor product","name":"kernel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Linux\",\n                    \"product\": \"Kernel\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"packageName\": \"kernel\",\n                    \"repo\": \"https://git.kernel.org\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.14.0\",\n                            \"lessThan\": \"4.14.322\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.15.0\",\n                            \"lessThan\": \"4.19.291\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.20.0\",\n                            \"lessThan\": \"5.4.248\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.5.0\",\n                            \"lessThan\": \"5.10.185\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.11.0\",\n                            \"lessThan\": \"5.15.118\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.16.0\",\n                            \"lessThan\": \"6.1.35\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.2.0\",\n                            \"lessThan\": \"6.3.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"6.4.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"04c55383fa5689357bcdd2c8036725a55ed632bc\",\n                            \"versionType\": \"git\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bc","https://kernel.dance/04c55383fa5689357bcdd2c8036725a55ed632bc","https://security.netapp.com/advisory/ntap-20230818-0005/","https://www.debian.org/security/2023/dsa-5480","http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html","http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-3609","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-3609","identifiers":["CVE-2023-3609"]},"retained":false,"historicalAffected":[]}],"coverage":[]}