CVE-2023-1838

HIGH

Linux Kernel 4.13-4.14.316 - Use-After-Free in vhost_net_set_backend

Title source: llm

Description

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.

References (2)

Core 2

Core References

Third Party Advisory

https://lore.kernel.org/netdev/20220516084213.26854-1-jasowang%40redhat.com/T/

Third Party Advisory, VDB Entry

https://security.netapp.com/advisory/ntap-20230517-0003/

Scores

CVSS v3 7.1

EPSS 0.0002

EPSS Percentile 6.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Details

CWE

CWE-416

Status published

Products (6)

linux/linux_kernel 4.13 - 4.14.317

netapp/h300s

netapp/h410c

netapp/h410s

netapp/h500s

netapp/h700s

Published Apr 05, 2023

Tracked Since Feb 18, 2026