CVE-2023-6932: Use-after-free in Linux kernel's ipv4: igmp component

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-19 · updated 2026-10-14
Weakness: CWE-416

Description

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

Affected products

Debian Linux: 10.0
Linux kernel: before 4.14.332; from 4.15 before 4.19.301; from 4.20 before 5.4.263; from 5.5 before 5.10.203; from 5.11 before 5.15.142; from 5.16 before 6.1.66 — fixed in 4.14.332, 4.19.301, 5.10.203, 5.15.142, 5.4.263, 6.1.66

How to fix

Upgrade to a fixed version: Linux kernel 4.14.332, 4.19.301, 5.10.203, 5.15.142. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6932 or the next vulnerability affects your stack