CVE-2023-6040: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-12 · updated 2026-06-17
Weakness: CWE-125

Description

An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.

Affected products

Debian Linux: 10.0
Linux kernel: from 4.16 before 4.19.305; from 4.20 before 5.4.267; from 5.5 before 5.10.208; from 5.11 before 5.15.147; from 5.16 before 5.18 — fixed in 4.19.305, 5.10.208, 5.15.147, 5.18, 5.4.267

How to fix

Upgrade to a fixed version: Linux kernel 4.19.305, 5.10.208, 5.15.147, 5.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6040 or the next vulnerability affects your stack