CVE-2023-3609 Use-after-free in Linux kernel's net/sched: cls_u32 component

High 7.8 Published 21 Jul 2023 Updated 14 Oct 2026

A use-after-free in the Linux kernel's cls_u32 component allows local attackers to escalate privileges by manipulating reference counters.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-3609?

CVE-2023-3609 is a high-severity use after free vulnerability in Debian Debian Linux, published on 21 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

Weakness: CWE-416

Which versions are affected by CVE-2023-3609?

It affects 2 products.

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2023-3609?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-3609 being exploited?

There is no known exploitation of CVE-2023-3609 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-27676, BELL-CVE-2023-3609, DEBIAN-CVE-2023-3609, GHSA-2qmp-8j6q-mcq6, UBUNTU-CVE-2023-3609.