Description
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.
Exploits (1)
nomisec
WORKING POC
13 stars
by SpiralBL0CK · poc
https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882
References (6)
Core 6
Core References
Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2175903
Vendor Advisory
https://security.netapp.com/advisory/ntap-20230929-0006/
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5480
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5492
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
Scores
CVSS v3
5.7
EPSS
0.0004
EPSS Percentile
12.1%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Lab Environment
COMMUNITY
Community Lab
Details
CWE
CWE-400
Status
published
Products (4)
fedoraproject/fedora
38
linux/linux_kernel
< 6.5
redhat/enterprise_linux
8.0
redhat/enterprise_linux
9.0
Published
Jun 30, 2023
Tracked Since
Feb 18, 2026