Description
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.5.8-1 | — |
| Debian 13 | linux | 6.5.8-1 | — |
| Debian 12 | linux | 6.1.76-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi | 6.7.0-1001.1 | — |
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-aws-6.5 | 6.5.0-1010.10~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-azure-6.5 | 6.5.0-1009.9~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.5 | 6.5.0-1007.7 | — |
| Ubuntu 22.04 LTS | linux-oem-6.1 | 6.1.0-1035.35 | USN-6688-1 |
| Ubuntu 22.04 LTS | linux-oem-6.5 | 6.5.0-1008.8 | USN-6503-1 |
| Ubuntu 22.04 LTS | linux-riscv +21 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.2.0-362.18.1.el9_3 | RHSA-2024:0461 |
| RHEL 9 | rv +64 | 5.14.0-362.18.1.el9_3 | RHSA-2024:0461 |
| RHEL 8 | kernel-rt +12 | 4.18.0-513.11.1.rt7.313.el8_9 | RHSA-2024:0134 |
| RHEL 8 | perf +26 | 4.18.0-513.11.1.el8_9 | RHSA-2024:0113 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | bpftool | 7.0.0-284.75.1.el9_2 | RHSA-2024:4823 |
| RHEL 9.2 EUS | kernel-rt +14 | 5.14.0-284.75.1.rt14.360.el9_2 | RHSA-2024:4831 |
| RHEL 9.2 EUS | perf +48 | 5.14.0-284.75.1.el9_2 | RHSA-2024:4823 |
| RHEL 8.8 EUS | perf +26 | 4.18.0-477.51.1.el8_8 | RHSA-2024:1404 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | perf +23 | 4.18.0-513.11.1.el8_9 | ALSA-2024:0113 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel-rt | 4.18.0-513.11.1.rt7.313.el8_9 | RLSA-2024:0134 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +6 | 6.4.0-150700.53.19.1 | SUSE-SU-2025:03601-1 |
| SLES 15 SP7 | kernel-azure +1 | 6.4.0-150700.20.15.2 | SUSE-SU-2025:03633-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.19.1.150700.17.13.1 | SUSE-SU-2025:03601-1 |
| SLES 15 SP7 | kernel-syms-azure | 6.4.0-150700.20.15.1 | SUSE-SU-2025:03633-1 |
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.39.1 | SUSE-SU-2023:4730-1 |
| SLES 15 SP5 | kernel-azure +2 | 5.14.21-150500.33.26.1 | SUSE-SU-2023:4734-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.39.1.150500.6.17.1 | SUSE-SU-2023:4730-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | kernel-default | 5.14.21-150500.55.39.1 | SUSE-SU-2023:4730-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.39.1.150500.6.17.1 | SUSE-SU-2023:4730-1 |
| SLE Micro 5.5 | kernel-rt | 5.14.21-150500.13.27.2 | SUSE-SU-2023:4732-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.19.1 | SUSE-SU-2025:03601-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_5 | 1-150700.1.3.1 | SUSE-SU-2025:3725-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_5 | 1-150700.15.3.1 | SUSE-SU-2025:03601-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.39.1 | SUSE-SU-2023:4730-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_8 | 1-150500.11.3.2 | SUSE-SU-2023:4732-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_8 | 1-150500.11.3.1 | SUSE-SU-2023:4730-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.19.1 | SUSE-SU-2025:3725-1 |
| SUSE Real Time Module 15 SP5 | kernel-rt +2 | 5.14.21-150500.13.27.2 | SUSE-SU-2023:4732-1 |
| SUSE Real Time Module 15 SP5 | kernel-syms-rt | 5.14.21-150500.13.27.1 | SUSE-SU-2023:4732-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | dtb-aarch64 +10 | 5.14.21-150500.55.39.1 | SUSE-SU-2023:4730-1 |
| openSUSE Leap 15.5 | kernel-azure +2 | 5.14.21-150500.33.26.1 | SUSE-SU-2023:4734-1 |
| openSUSE Leap 15.5 | kernel-default-base | 5.14.21-150500.55.39.1.150500.6.17.1 | SUSE-SU-2023:4730-1 |
| openSUSE Leap 15.5 | kernel-rt +2 | 5.14.21-150500.13.27.2 | SUSE-SU-2023:4732-1 |
| openSUSE Leap 15.5 | kernel-syms-rt | 5.14.21-150500.13.27.1 | SUSE-SU-2023:4732-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.153.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bpftool | 7.2.0-362.18.1.el9_3 | ELSA-2024-0461 |
| Oracle Linux 9 | rv +25 | 5.14.0-362.18.1.el9_3 | ELSA-2024-0461 |
Advisories 18
- ALSA-2024:0113 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-6688-1 linux-oem-6.1 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- RHSA-2024:4831 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:4823 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:1404 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0461 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0113 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- RHSA-2024:0134 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 26, 2026
- USN-6503-1 linux, linux-aws, linux-laptop, linux-lowlatency, linux-oem-6.5, linux-oracle, linux-raspi, linux-starfive vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- SUSE-SU-2025:03633-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03601-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2024:0134 Important: kernel-rt security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2023:4734-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4732-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3725-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1086 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2025
- SUSE-SU-2023:4730-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2024-0461 Important: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 7, 2024
References
- RHSA-2024:0113 vendor-advisory
- RHSA-2024:0134 vendor-advisory
- RHSA-2024:0461 vendor-advisory
- RHSA-2024:1404 vendor-advisory
- RHSA-2024:4823 vendor-advisory
- RHSA-2024:4831 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5633 vdb-entry
- RHBZ#2245663 issue-tracking