CVE-2023-42756: Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-28 · updated 2026-11-01
Weakness: CWE-362

Description

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.

Affected products

Debian Linux: 10.0 (and their updates)
Fedoraproject Fedora: 37, 38, 39 (and their updates)
Linux kernel: before 6.6; 6.6-rc1, 6.6-rc2 — fixed in 6.6
Red Hat Enterprise Linux: 9.0 (and their updates)
Red Hat Enterprise Linux 9: all versions — fixed in 0:5.14.0-427.13.1.el9_4

How to fix

Upgrade to a fixed version: Linux kernel 6.6; Red Hat Enterprise Linux 9 0:5.14.0-427.13.1.el9_4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-42756 or the next vulnerability affects your stack