What’s Vulnerable › Vulnerabilities

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-14 · updated 2026-10-15
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.18 before 6.1.130; from 6.2 before 6.6 — fixed in 6.1.130, 6.6

How to fix

Upgrade to a fixed version: Linux kernel 6.1.130, 6.6. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec
• https://git.kernel.org/stable/c/4914109a8e1e494c6aa9852f9e84ec77a5fc643f
• https://seadragnol.github.io/posts/CVE-2023-52927/
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-457936.html
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2023-52927 or the next vulnerability affects your stack