Description
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | kernel | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Fedora | Fedora | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.3.11-1 | — |
| Debian 13 | linux | 6.3.11-1 | — |
| Debian 12 | linux | 6.1.37-1 | DSA-5448-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux-aws-6.2 +1 | 6.2.0-1008.8~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gcp-6.2 | 6.2.0-1010.10~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-hwe-6.2 | 6.2.0-26.26~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.2 | 6.2.0-1009.9~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-oem-6.1 | 6.1.0-1017.17 | USN-6249-1 |
| Ubuntu 22.04 LTS | linux-riscv +7 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv +23 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 6.4.2-1.1 | openSUSE-SU-2024:13704-1, openSUSE-SU-2024:13042-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.34-59.116 | 1.0-0.amzn2023 | ALAS2023-2023-234 |
| Amazon Linux 2023 | perf +12 | 6.1.34-59.116.amzn2023 | ALAS2023-2023-234 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | hyperv-daemons | 5.15.158.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.122.1-2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
lrh2000/StackRot ★ 499 · Jun 28, 2023
CVE-2023-3269: Linux kernel privilege escalation vulnerability
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- USN-6249-1 linux-oem-6.1 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- DSA-5448-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13704-1 kernel-devel-longterm-6.6.17-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13042-1 kernel-devel-6.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1670 Linux Kernel: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jul 25, 2023
- ALAS2023-2023-234 Moderate: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 5, 2023
References
- https://access.redhat.com/security/cve/CVE-2023-3269 vdb-entry
- RHBZ#2215268 issue-tracking
- https://www.openwall.com/lists/oss-security/2023/07/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6AAA64CUPSMBW6XDTXPQJ3KQWYQ4K7L/
- http://seclists.org/fulldisclosure/2023/Jul/43
- http://www.openwall.com/lists/oss-security/2023/07/28/1
- http://www.openwall.com/lists/oss-security/2023/08/25/1
- http://www.openwall.com/lists/oss-security/2023/08/25/4
- https://security.netapp.com/advisory/ntap-20230908-0001/