---
id: CVE-2023-2008
title: >-
  A flaw was found in the Linux kernel's udmabuf device driver, within a fault
  handler
summary: >-
  A flaw was found in the Linux kernel's udmabuf device driver, within a fault
  handler. This issue occurs due to the lack of proper validation of
  user-supplied data, which can result in memory access past the end of an
  array. This may allo…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-129
  - CWE-129
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 5.19
  - 'linux_kernel >= 4.20, < 5.4.202'
  - 'linux_kernel >= 5.5, < 5.10.127'
  - 'linux_kernel >= 5.11, < 5.15.51'
  - 'linux_kernel >= 5.16, < 5.18.8'
  - linux_kernel = 5.19
patched:
  - linux_kernel 5.18.8
published: '2023-04-14'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-2008'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2022:7933'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2022:8267'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2023:3465'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2023:3470'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2023:3490'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2023-2008'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2186862'
    label: secalert@redhat.com
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-23-441/'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2186862'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/torvalds/linux/commit/05b252cccb2e5c3f56119d25de684b4f810ba4
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230517-0007/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-23-441/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.0101
epssPercentile: 0.61594
zeroDay: true
ingestedAt: '2026-08-11T16:47:02.518Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/bluefrostsecurity/CVE-2023-2008'
  checkedAt: '2026-09-26T09:05:29.585Z'
exploitAvailable: true
---

## Overview

A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

## Affected

- `linux_kernel < 5.19`
- `linux_kernel >= 4.20, < 5.4.202`
- `linux_kernel >= 5.5, < 5.10.127`
- `linux_kernel >= 5.11, < 5.15.51`
- `linux_kernel >= 5.16, < 5.18.8`
- `linux_kernel = 5.19`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.18.8`