CVE-2023-52927: Linux Kernel use-after-free (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Debian Linux11.0

Linux Kernel≥ 5.18 < 6.1.130 · ≥ 6.2 < 6.6

Remediation

Fixed in

Linux Kernel≥ 6.1.130

References

https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://git.kernel.org/stable/c/3fa58a6fbd1e9e5682d09cdafb08fba004cb12ecBroken Link
https://git.kernel.org/stable/c/4914109a8e1e494c6aa9852f9e84ec77a5fc643fBroken Link
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlIssue TrackingThird Party Advisory
https://seadragnol.github.io/posts/CVE-2023-52927/ExploitTechnical Description

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-52927 being actively exploited?

CVE-2023-52927 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.32%.

How severe is CVE-2023-52927?

CVE-2023-52927 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 0.32% probability of exploitation.

Which products are affected by CVE-2023-52927?

Affected products include Debian Linux, Linux Kernel.

How do I fix CVE-2023-52927?

Upgrade affected software to a fixed version, for example Linux Kernel 6.1.130 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-52927 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo