{"id":"CVE-2023-3390","title":"A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction caus…","summary":"A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction caus…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.16, < 4.14.322","linux_kernel >= 4.15, < 4.19.291","linux_kernel >= 4.20, < 5.4.251","linux_kernel >= 5.5, < 5.10.188","linux_kernel >= 5.11, < 5.15.118","linux_kernel >= 5.16, < 6.1.35","linux_kernel >= 6.2, < 6.3.9","h300s","h410c","h410s","h500s","h700s"],"patched":["linux_kernel 6.3.9"],"published":"2023-06-28","updated":"2026-07-22","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-3390","references":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97","label":"cve-coordination@google.com"},{"url":"https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-security-announce/2023/msg00140.html","label":"cve-coordination@google.com"},{"url":"https://lists.debian.org/debian-security-announce/2023/msg00153.html","label":"cve-coordination@google.com"},{"url":"https://packetstorm.news/tos/aHR0cHM6Ly9wYWNrZXRzdG9ybS5uZXdzL2ZpbGVzLzE3NDU3Ny9LZXJuZWwtTGl2ZS1QYXRjaC1TZWN1cml0eS1Ob3RpY2UtTFNOLTAwOTctMS5odG1sIDE3ODQ3MjE0NzIgODFlMjk3ZjBmM2FiMTIwOTI5Nzg0ZmRlNGM2NWNjNjBhMThhMzBiOGE5NjQ0YzQ0NTFhMzJlZjhiNTk1ZTk2Yg==","label":"cve-coordination@google.com"},{"url":"https://security.netapp.com/advisory/ntap-20230818-0004/","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230818-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5448","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5461","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.00914,"epssPercentile":0.58056,"ingestedAt":"2026-07-22T13:03:40.046Z","exploits":{"github":1,"githubRepos":["https://github.com/flygonty/CVE-2023-3390_PoC"],"checkedAt":"2026-09-21T15:25:49.913Z"},"exploitAvailable":true,"slug":"CVE-2023-3390","body":"## Overview\n\nA use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.\n\nWe recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97\n\n## Affected\n\n- `linux_kernel >= 3.16, < 4.14.322`\n- `linux_kernel >= 4.15, < 4.19.291`\n- `linux_kernel >= 4.20, < 5.4.251`\n- `linux_kernel >= 5.5, < 5.10.188`\n- `linux_kernel >= 5.11, < 5.15.118`\n- `linux_kernel >= 5.16, < 6.1.35`\n- `linux_kernel >= 6.2, < 6.3.9`\n- `h300s`\n- `h410c`\n- `h410s`\n- `h500s`\n- `h700s`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.3.9`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4648,"id":"CVE-2023-3390","ts":1788887197176,"field":"exploit_available","old":"false","new":"true"},{"seq":3531,"id":"CVE-2023-3390","ts":1788886313250,"field":"exploit_available","old":"true","new":"false"},{"seq":2385,"id":"CVE-2023-3390","ts":1788882982567,"field":"exploit_available","old":"false","new":"true"},{"seq":1414,"id":"CVE-2023-3390","ts":1788882395428,"field":"exploit_available","old":"true","new":"false"},{"seq":528,"id":"CVE-2023-3390","ts":1788881831578,"field":"exploit_available","old":"false","new":"true"}]}