What’s Vulnerable › Vulnerabilities

CVE-2023-52433: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-20 · updated 2026-08-04
• Weakness: CWE-273

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.

Affected products

• Linux kernel: from 6.5 before 6.5.4 — fixed in 6.5.4
• NetApp Ontap Tools: 9, 10

How to fix

Upgrade to a fixed version: Linux kernel 6.5.4. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017
• https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
• https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
• https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce
• https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127
• https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8
• https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a
• https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017
• https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
• https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
• https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce
• https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127

Get alerted when CVE-2023-52433 or the next vulnerability affects your stack