CVE-2023-4004: Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-31 · updated 2026-10-14
Weakness: CWE-416

Description

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Affected products

Debian Linux: 10.0, 11.0, 12.0
Fedoraproject Fedora: 38
Linux kernel: from 5.6 before 5.10.188; from 5.11 before 5.15.123; from 5.16 before 6.1.42; from 6.2 before 6.4.7 — fixed in 5.10.188, 5.15.123, 6.1.42, 6.4.7
NetApp H300S: all versions
NetApp H410S: all versions
NetApp H500S: all versions
NetApp H700S: all versions
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.188, 5.15.123, 6.1.42, 6.4.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4004 or the next vulnerability affects your stack