---
id: CVE-2023-52433
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

  New elements in this transaction might expired before such transaction
  ends
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

  New elements in this transaction might expired before such transaction
  ends. Skip sync GC …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-273
vendor: netapp
product: ontap_tools
affected:
  - ontap_tools = 9
  - ontap_tools = 10
  - 'linux_kernel >= 6.5, < 6.5.4'
patched:
  - linux_kernel 6.5.4
published: '2024-02-20'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-52433'
references:
  - url: 'https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240828-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.0025
epssPercentile: 0.14595
ingestedAt: '2026-08-04T10:39:37.135Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

New elements in this transaction might expired before such transaction
ends. Skip sync GC for such elements otherwise commit path might walk
over an already released object. Once transaction is finished, async GC
will collect such expired element.

## Affected

- `ontap_tools = 9`
- `ontap_tools = 10`
- `linux_kernel >= 6.5, < 6.5.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.5.4`