What’s Vulnerable › Vulnerabilities

CVE-2023-3111

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-05 · updated 2026-06-17
• Weakness: CWE-416

Description

A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().

Affected products

• Debian Linux: 10.0, 11.0
• Linux kernel: from 2.6.31 before 4.14.318; from 4.15 before 4.19.286; from 4.20 before 5.4.247; from 5.5 before 5.10.184; from 5.11 before 5.15.63; from 5.16 before 5.19.4 — fixed in 4.14.318, 4.19.286, 5.10.184, 5.15.63, 5.19.4, 5.4.247
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.318, 4.19.286, 5.10.184, 5.15.63. Check the vendor advisory for mitigations.

References

• https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
• https://patchwork.kernel.org/project/linux-btrfs/patch/20220721074829.2905233-1-r33s3n6%40gmail.com/
• https://security.netapp.com/advisory/ntap-20230703-0007/
• https://www.debian.org/security/2023/dsa-5480
• https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
• https://patchwork.kernel.org/project/linux-btrfs/patch/20220721074829.2905233-1-r33s3n6%40gmail.com/
• https://security.netapp.com/advisory/ntap-20230703-0007/
• https://www.debian.org/security/2023/dsa-5480

Get alerted when CVE-2023-3111 or the next vulnerability affects your stack