CVE-2023-1206

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-30 · updated 2026-10-14
Weakness: CWE-400

Description

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.

Affected products

Fedoraproject Fedora: 38
Linux kernel: before 6.5 — fixed in 6.5
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 6.5. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2175903
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://security.netapp.com/advisory/ntap-20230929-0006/
https://www.debian.org/security/2023/dsa-5480
https://www.debian.org/security/2023/dsa-5492
https://bugzilla.redhat.com/show_bug.cgi?id=2175903
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://security.netapp.com/advisory/ntap-20230929-0006/
https://www.debian.org/security/2023/dsa-5480
https://www.debian.org/security/2023/dsa-5492

Get alerted when CVE-2023-1206 or the next vulnerability affects your stack