{"id":"CVE-2023-1281","title":"Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()…","summary":"Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.14, < 5.10.169","linux_kernel >= 5.11, < 5.15.95","linux_kernel >= 5.16, < 6.1.13","linux_kernel = 6.2"],"patched":["linux_kernel 6.1.13"],"published":"2023-03-22","updated":"2026-07-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-1281","references":[{"url":"http://www.openwall.com/lists/oss-security/2023/04/11/3","label":"cve-coordination@google.com"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2","label":"cve-coordination@google.com"},{"url":"https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html","label":"cve-coordination@google.com"},{"url":"https://security.netapp.com/advisory/ntap-20230427-0004/","label":"cve-coordination@google.com"},{"url":"http://www.openwall.com/lists/oss-security/2023/04/11/3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230427-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.00304,"epssPercentile":0.23398,"ingestedAt":"2026-07-30T17:54:54.454Z","exploits":{"github":1,"githubRepos":["https://github.com/lanleft/CVE-2023-1281"],"checkedAt":"2026-09-23T07:13:24.609Z"},"exploitAvailable":true,"slug":"CVE-2023-1281","body":"## Overview\n\nUse After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root.\n\n\nThis issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.\n\n## Affected\n\n- `linux_kernel >= 4.14, < 5.10.169`\n- `linux_kernel >= 5.11, < 5.15.95`\n- `linux_kernel >= 5.16, < 6.1.13`\n- `linux_kernel = 6.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.1.13`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4639,"id":"CVE-2023-1281","ts":1788887196425,"field":"exploit_available","old":"false","new":"true"},{"seq":3522,"id":"CVE-2023-1281","ts":1788886312547,"field":"exploit_available","old":"true","new":"false"},{"seq":2376,"id":"CVE-2023-1281","ts":1788882981918,"field":"exploit_available","old":"false","new":"true"},{"seq":1405,"id":"CVE-2023-1281","ts":1788882394701,"field":"exploit_available","old":"true","new":"false"},{"seq":519,"id":"CVE-2023-1281","ts":1788881830607,"field":"exploit_available","old":"false","new":"true"}]}