CVE-2023-54243netfilter: ebtables: fix table blob use-after-free
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c58dd2dd443c26d856a168db108a0cd11c285bf3 before 9060abce3305ab2354c892c09d5689df51486df5; from c58dd2dd443c26d856a168db108a0cd11c285bf3 before dbb3cbbf03b3c52cb390fabec357f1e4638004f5; from c58dd2dd443c26d856a168db108a0cd11c285bf3 before 3dd6ac973351308d4117eda32298a9f1d68764fd; from c58dd2dd443c26d856a168db108a0cd11c285bf3 before cda0e0243bd3c04008fcd37a46b0269fb3c49249; from c58dd2dd443c26d856a168db108a0cd11c285bf3 before e58a171d35e32e6e8c37cfe0e8a94406732a331f; a3bc0f8ea439762aa62d40a295157410498cbea7; 8ed40c122919cd79bc3c059e5864e5e7d9d455f0; c5e4ef499cfc78de45a4f01b8c557b5964d77c53; and 7 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/9060abce3305ab2354c892c09d5689df51486df5
- https://git.kernel.org/stable/c/dbb3cbbf03b3c52cb390fabec357f1e4638004f5
- https://git.kernel.org/stable/c/3dd6ac973351308d4117eda32298a9f1d68764fd
- https://git.kernel.org/stable/c/cda0e0243bd3c04008fcd37a46b0269fb3c49249
- https://git.kernel.org/stable/c/e58a171d35e32e6e8c37cfe0e8a94406732a331f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.