CVE-2023-3389: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only; version 22.04 only
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Linux Linux Kernel: from 5.10.162, before 5.10.185 (fixed in 5.10.185); from 5.13, before 6.4 (fixed in 6.4)

Published 2023-06-28. Last modified 2026-06-17.