CVE-2023-4611

Use after free race between mbind() and vma-locked page fault

State: Published
Severity: 7.0 High
Published: Aug 29, 2023
Updated: Feb 27, 2025
Reserved: Aug 29, 2023

Description

A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
Kerneln/a	6.5-rc4Not affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat
Red Hat Enterprise Linux 9Red Hat
FedoraFedora

References

https://access.redhat.com/security/cve/CVE-2023-4611vdb-entry
RHBZ#2227244issue-tracking
https://www.spinics.net/lists/stable-commits/msg310136.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.