CVE-2023-6931

Out-of-bounds write in Linux kernel's Performance Events system component

State: Published
Severity: 7.8 High
Published: Dec 19, 2023
Updated: Oct 14, 2026
Reserved: Dec 18, 2023

Description

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Google

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
Linux KernelLinux	4.3.0 to before 4.19.302Affected 4.20.0 to before 5.4.264Affected 5.5.0 to before 5.10.204Affected 5.11.0 to before 5.15.143Affected 5.16.0 to before 6.1.68Affected 6.2.0 to before 6.6.7Affected 6.7.0Not affected 382c27f4ed28f803b1f1473ac2d8db0afc795a1bNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.