CVE-2023-26545 Use after free in n/a

Medium 4.7 Published 25 Feb 2023 Updated 20 Mar 2025

A double free vulnerability in the Linux kernel MPLS module allows attackers to cause a denial of service or potentially execute code via device renaming.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-26545?

CVE-2023-26545 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 25 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.

Weakness: CWE-415

Which versions are affected by CVE-2023-26545?

It affects 7 products.

Linux distribution packages (8)

`kgraft-patch-SLE12-SP4_Update_30` SUSE:Linux Enterprise Live Patching 12 SP4	All versions	`6-2.3`
`kgraft-patch-SLE12-SP4_Update_32` SUSE:Linux Enterprise Live Patching 12 SP4	All versions	`3-2.3`
`kgraft-patch-SLE12-SP4_Update_33` SUSE:Linux Enterprise Live Patching 12 SP4	All versions	`2-2.3`
`kgraft-patch-SLE12-SP5_Update_40` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`2-2.3`
`kernel-livepatch-SLE15-SP1_Update_30` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`13-150100.2.3`
`kernel-livepatch-SLE15-SP1_Update_34` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`5-150100.2.3`
`kernel-livepatch-SLE15-SP1_Update_35` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`5-150100.2.3`
`kernel-livepatch-SLE15-SP1_Update_37` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`2-150100.2.3`

Products include Debian Debian Linux, Linux kernel, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, Netapp H500s Firmware and 1 more.

How do I fix CVE-2023-26545?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-26545 being exploited?

There is no known exploitation of CVE-2023-26545 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-13775, AZL-25583, DEBIAN-CVE-2023-26545, GHSA-9vm4-7h35-5g6c, SUSE-SU-2023:1579-1, SUSE-SU-2023:1588-1 and 4 more.