CVE-2023-3159

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-12 · updated 2026-06-17
Weakness: CWE-416

Description

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.

Affected products

Linux kernel: before 5.18; 5.18, 5.18-rc1, 5.18-rc2, 5.18-rc3, 5.18-rc4, 5.18-rc5 — fixed in 5.18

How to fix

Upgrade to a fixed version: Linux kernel 5.18. Check the vendor advisory for mitigations.

References

https://github.com/torvalds/linux/commit/b7c81f80246fac44077166f3e07103affe6db8ff
https://github.com/torvalds/linux/commit/b7c81f80246fac44077166f3e07103affe6db8ff

Get alerted when CVE-2023-3159 or the next vulnerability affects your stack