CVE-2023-1075 Information disclosure in Linus kernel

Low 3.3 Published 27 Mar 2023 Updated 24 Feb 2025

A flaw in the Linux kernel TLS implementation allows leaking memory contents due to incorrect list emptiness checks, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-1075?

CVE-2023-1075 is a low-severity vulnerability in Linux kernel, published on 27 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready.

Weakness: CWE-843, CWE-200

Which versions are affected by CVE-2023-1075?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2023-1075?

Apply the vendor's patch.

Is CVE-2023-1075 being exploited?

There is no known exploitation of CVE-2023-1075 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-1075, GHSA-656v-jx98-63w5, UBUNTU-CVE-2023-1075.