CVE-2023-4623 Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

High 7.8 Published 6 Sep 2023 Updated 14 Oct 2026

A use-after-free in the Linux kernel's HFSC qdisc allows local attackers to escalate privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-4623?

CVE-2023-4623 is a high-severity use after free vulnerability in Debian Debian Linux, published on 6 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

Weakness: CWE-416

Which versions are affected by CVE-2023-4623?

It affects 2 products.

Linux distribution packages (33)

`bpftool` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-debug` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-debug-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-doc` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-tools` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-tools-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-tools-libs` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kernel-tools-libs-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`perf` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`perf-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`python-perf` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`python-perf-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.112.1.el7`
`kgraft-patch-SLE12-SP5_Update_36` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`12-2.3`
`kgraft-patch-SLE12-SP5_Update_42` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`7-2.2`
`kgraft-patch-SLE12-SP5_Update_43` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`6-2.2`
`kgraft-patch-SLE12-SP5_Update_44` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`5-2.2`
`kgraft-patch-SLE12-SP5_Update_45` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`4-2.2`
`kgraft-patch-SLE12-SP5_Update_47` SUSE:Linux Enterprise Live Patching 12 SP5	All versions	`3-2.2`
`kernel-livepatch-SLE15-SP1_Update_35` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`12-150100.2.3`
`kernel-livepatch-SLE15-SP1_Update_36` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`10-150100.2.3`
`kernel-livepatch-SLE15-SP1_Update_41` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`5-150100.2.2`
`kernel-livepatch-SLE15-SP1_Update_42` SUSE:Linux Enterprise Live Patching 15 SP1	All versions	`4-150100.2.2`
`kernel-livepatch-SLE15-SP2_Update_39` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`3-150200.2.1`
`kernel-livepatch-SLE15-SP4-RT_Update_13` SUSE:Linux Enterprise Live Patching 15 SP4	All versions	`2-150400.2.1`
`kernel-livepatch-SLE15-SP4_Update_18` SUSE:Linux Enterprise Live Patching 15 SP4	All versions	`2-150400.2.1`
`kernel-livepatch-SLE15-SP5-RT_Update_5` SUSE:Linux Enterprise Live Patching 15 SP5	All versions	`2-150500.2.1`
`kernel-livepatch-SLE15-SP5_Update_5` SUSE:Linux Enterprise Live Patching 15 SP5	All versions	`2-150500.2.1`

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2023-4623?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-4623 being exploited?

There is no known exploitation of CVE-2023-4623 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-31697, BELL-CVE-2023-4623, DEBIAN-CVE-2023-4623, GHSA-j8c5-g64v-xj97, RHSA-2024:1747, SUSE-SU-2023:4164-1 and 9 more.