---
id: CVE-2023-3777
title: >-
  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables
  component can be exploited to achieve local privilege escalation.


  When nf_tables_delrule() is flushing table rules, it is not checked whether
  the chain is bound a…
summary: >-
  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables
  component can be exploited to achieve local privilege escalation.


  When nf_tables_delrule() is flushing table rules, it is not checked whether
  the chain is bound a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.9, < 5.10.188'
  - 'linux_kernel >= 5.11, < 5.15.123'
  - 'linux_kernel >= 5.16, < 6.1.42'
  - 'linux_kernel >= 6.2, < 6.4.7'
  - debian_linux = 12.0
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 20.04
  - ubuntu_linux = 22.04
patched:
  - linux_kernel 6.4.7
published: '2023-09-06'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:17:15.917'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-3777'
references:
  - url: >-
      http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
    label: cve-coordination@google.com
  - url: >-
      http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
    label: cve-coordination@google.com
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
    label: cve-coordination@google.com
  - url: 'https://kernel.dance/6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8'
    label: cve-coordination@google.com
  - url: 'https://www.debian.org/security/2023/dsa-5492'
    label: cve-coordination@google.com
  - url: >-
      http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://kernel.dance/6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2023/dsa-5492'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00406
epssPercentile: 0.33182
ingestedAt: '2026-10-14T23:00:02.002Z'
---

## Overview

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

## Affected

- `linux_kernel >= 5.9, < 5.10.188`
- `linux_kernel >= 5.11, < 5.15.123`
- `linux_kernel >= 5.16, < 6.1.42`
- `linux_kernel >= 6.2, < 6.4.7`
- `debian_linux = 12.0`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 20.04`
- `ubuntu_linux = 22.04`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.4.7`