CVE-2023-3390: Use-after-free in Linux kernel's netfilter subsystem

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-28 · updated 2026-07-22
Weakness: CWE-416

Description

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97

Affected products

Linux kernel: from 3.16 before 4.14.322; from 4.15 before 4.19.291; from 4.20 before 5.4.251; from 5.5 before 5.10.188; from 5.11 before 5.15.118; from 5.16 before 6.1.35 — fixed in 4.14.322, 4.19.291, 5.10.188, 5.15.118, 5.4.251, 6.1.35
NetApp H300S: all versions
NetApp H410C: all versions
NetApp H410S: all versions
NetApp H500S: all versions
NetApp H700S: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.322, 4.19.291, 5.10.188, 5.15.118. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3390 or the next vulnerability affects your stack