{"id":"CVE-2023-52447","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer the free of inner map when necessary\n\nWhen updating or deleting an inner map in map array or map htab, the map\nmay still be accessed by non-sleepable program…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer the free of inner map when necessary\n\nWhen updating or deleting an inner map in map array or map htab, the map\nmay still be accessed by non-sleepable program…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.9.0, < 5.10.214","linux_kernel >= 5.11, < 5.15.153","linux_kernel >= 5.16, < 6.1.75","linux_kernel >= 6.2, < 6.6.14","linux_kernel >= 6.7, < 6.7.2"],"patched":["linux_kernel 6.7.2"],"published":"2024-02-22","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-52447","references":[{"url":"https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.00249,"epssPercentile":0.16594,"ingestedAt":"2026-08-04T10:39:37.735Z","slug":"CVE-2023-52447","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer the free of inner map when necessary\n\nWhen updating or deleting an inner map in map array or map htab, the map\nmay still be accessed by non-sleepable program or sleepable program.\nHowever bpf_map_fd_put_ptr() decreases the ref-counter of the inner map\ndirectly through bpf_map_put(), if the ref-counter is the last one\n(which is true for most cases), the inner map will be freed by\nops->map_free() in a kworker. But for now, most .map_free() callbacks\ndon't use synchronize_rcu() or its variants to wait for the elapse of a\nRCU grace period, so after the invocation of ops->map_free completes,\nthe bpf program which is accessing the inner map may incur\nuse-after-free problem.\n\nFix the free of inner map by invoking bpf_map_free_deferred() after both\none RCU grace period and one tasks trace RCU grace period if the inner\nmap has been removed from the outer map before. The deferment is\naccomplished by using call_rcu() or call_rcu_tasks_trace() when\nreleasing the last ref-counter of bpf map. The newly-added rcu_head\nfield in bpf_map shares the same storage space with work field to\nreduce the size of bpf_map.\n\n## Affected\n\n- `linux_kernel >= 5.9.0, < 5.10.214`\n- `linux_kernel >= 5.11, < 5.15.153`\n- `linux_kernel >= 5.16, < 6.1.75`\n- `linux_kernel >= 6.2, < 6.6.14`\n- `linux_kernel >= 6.7, < 6.7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.7.2`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}