CVE-2023-3812 Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

High 7.8 Published 24 Jul 2023 Updated 26 Feb 2026

A local attacker can trigger out-of-bounds memory access in the Linux kernel TUN driver to crash the system or escalate privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-3812?

CVE-2023-3812 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Weakness: CWE-416, CWE-787

Which versions are affected by CVE-2023-3812?

It affects 2 products.

Linux distribution packages (9)

`kpatch-patch-4_18_0-193_116_1` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-4.el8_2`
`kpatch-patch-4_18_0-193_116_1-debuginfo` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-4.el8_2`
`kpatch-patch-4_18_0-193_116_1-debugsource` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-4.el8_2`
`kpatch-patch-4_18_0-193_119_1` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-3.el8_2`
`kpatch-patch-4_18_0-193_119_1-debuginfo` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-3.el8_2`
`kpatch-patch-4_18_0-193_119_1-debugsource` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-3.el8_2`
`kpatch-patch-4_18_0-193_120_1` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-2.el8_2`
`kpatch-patch-4_18_0-193_120_1-debuginfo` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-2.el8_2`
`kpatch-patch-4_18_0-193_120_1-debugsource` Red Hat:rhel_e4s:8.2::baseos	All versions	`0:1-2.el8_2`

Products include Linux kernel, Redhat Enterprise Linux.

How do I fix CVE-2023-3812?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-3812 being exploited?

There is no known exploitation of CVE-2023-3812 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-27764, DEBIAN-CVE-2023-3812, GHSA-v4mv-7g6h-5vh8, RHSA-2024:1961, UBUNTU-CVE-2023-3812.