CVE-2023-31436: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.

Affected products

• Linux Linux Kernel: from 3.7, before 4.14.314 (fixed in 4.14.314); from 4.15, before 4.19.282 (fixed in 4.19.282); from 4.20, before 5.4.242 (fixed in 5.4.242); from 5.5.0, before 5.10.179 (fixed in 5.10.179); from 5.11, before 5.15.109 (fixed in 5.15.109); from 5.16, before 6.1.26 (fixed in 6.1.26); …

Published 2023-04-28. Last modified 2026-06-17.