CVE-2023-3390: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97

Affected products

• Linux Linux Kernel: from 3.16, before 4.14.322 (fixed in 4.14.322); from 4.15, before 4.19.291 (fixed in 4.19.291); from 4.20, before 5.4.251 (fixed in 5.4.251); from 5.5, before 5.10.188 (fixed in 5.10.188); from 5.11, before 5.15.118 (fixed in 5.15.118); from 5.16, before 6.1.35 (fixed in 6.1.35); …
• Netapp h300s: affected versions not specified
• Netapp h410c: affected versions not specified
• Netapp h410s: affected versions not specified
• Netapp h500s: affected versions not specified
• Netapp h700s: affected versions not specified

Published 2023-06-28. Last modified 2026-07-22.