CVE detail
CVE-2023-3609
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 23.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
9 source links · newest first
Researchers from the Graz University of Technology have discovered a way to convert a limited heap vulnerability in the Linux kernel into a malicious memory writes capability to demonstrate novel software cross-cache attacks. While such vulnerabilities are known to be restricted in capabilities, allowing the corruption of only a few bytes in restricted allocator caches, […]
newswww.csoonline.comAug 5, 2024, 1:03 PM- https://www.debian.org/security/2023/dsa-5480www.debian.org
No excerpt available.
Vendor Advisorywww.debian.orgJul 21, 2023, 9:15 PM - https://security.netapp.com/advisory/ntap-20230818-0005/security.netapp.com
No excerpt available.
Exploitsecurity.netapp.comJul 21, 2023, 9:15 PM No excerpt available.
Vendor Advisorylists.debian.orgJul 21, 2023, 9:15 PMNo excerpt available.
Vendor Advisorylists.debian.orgJul 21, 2023, 9:15 PMNo excerpt available.
Exploitkernel.danceJul 21, 2023, 9:15 PM- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=04c55383fa5689357bcdd2c8036725a55ed632bcgit.kernel.org
No excerpt available.
Exploitgit.kernel.orgJul 21, 2023, 9:15 PM - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.htmlpacketstormsecurity.com
No excerpt available.
Exploitpacketstormsecurity.comJul 21, 2023, 9:15 PM - http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.htmlpacketstormsecurity.com
No excerpt available.
Exploitpacketstormsecurity.comJul 21, 2023, 9:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2025-39881CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in…
- CVE-2025-39877CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damo…
- CVE-2025-39873CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership…
- CVE-2025-39866CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_…
- CVE-2025-39864CVSS 8.8 · High
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f…
- CVE-2025-39860CVSS 8.0 · High
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro.…