CVE-2023-31248: Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-05 · updated 2026-06-17
Weakness: CWE-416

Description

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04, 22.04
Debian Linux: 11.0
Fedoraproject Fedora: 37, 38
Linux kernel: from 5.9 before 5.10.188; from 5.11 before 5.15.121; from 5.16 before 6.1.39; from 6.2 before 6.4.4 — fixed in 5.10.188, 5.15.121, 6.1.39, 6.4.4

How to fix

Upgrade to a fixed version: Linux kernel 5.10.188, 5.15.121, 6.1.39, 6.4.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-31248 or the next vulnerability affects your stack