CVE-2023-5178 Kernel: use after free in nvmet_tcp_free_crypto in nvme

High 8.8 Published 1 Nov 2023 Updated 14 Oct 2026

A use-after-free bug in the Linux kernel NVMe/TCP subsystem allows attackers to achieve remote code execution or local privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-5178?

CVE-2023-5178 is a high-severity use after free vulnerability in Linux kernel, published on 1 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

Weakness: CWE-416

Which versions are affected by CVE-2023-5178?

It affects 5 products.

Linux distribution packages (12)

`kpatch-patch-4_18_0-305_103_1` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-2.el8_4`
`kpatch-patch-4_18_0-305_103_1-debuginfo` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-2.el8_4`
`kpatch-patch-4_18_0-305_103_1-debugsource` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-2.el8_4`
`kpatch-patch-4_18_0-305_108_1` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-1.el8_4`
`kpatch-patch-4_18_0-305_108_1-debuginfo` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-1.el8_4`
`kpatch-patch-4_18_0-305_108_1-debugsource` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-1.el8_4`
`kpatch-patch-4_18_0-305_91_1` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-4.el8_4`
`kpatch-patch-4_18_0-305_91_1-debuginfo` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-4.el8_4`
`kpatch-patch-4_18_0-305_91_1-debugsource` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-4.el8_4`
`kpatch-patch-4_18_0-305_97_1` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-3.el8_4`
`kpatch-patch-4_18_0-305_97_1-debuginfo` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-3.el8_4`
`kpatch-patch-4_18_0-305_97_1-debugsource` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:1-3.el8_4`

Products include Linux kernel, Netapp Active Iq Unified Manager, Netapp Solidfire \& Hci Management Node, Netapp Solidfire \& Hci Storage Node, Redhat Enterprise Linux.

How do I fix CVE-2023-5178?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-5178 being exploited?

There is no known exploitation of CVE-2023-5178 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Linux kernel vulnerabilities

Sources

Also known as AZL-31777, AZL-31852, BELL-CVE-2023-5178, DEBIAN-CVE-2023-5178, GHSA-xr9j-c7v6-7542, RHSA-2023:7559 and 1 more.