CVE-2023-2006

State: Published
Severity: 7.0 High
Published: Apr 24, 2023
Updated: Apr 23, 2025
Reserved: Apr 12, 2023

Description

A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-362

Affected Products

Product	Versions
Linux kernel's RxRPC network protocoln/a	Fixed in kernel v6.1-rc7Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=2189112
https://www.zerodayinitiative.com/advisories/ZDI-23-439/
https://github.com/torvalds/linux/commit/3bcd6c7eaa53
https://security.netapp.com/advisory/ntap-20230609-0004/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.