CVE-2023-42756: Debian Linux

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
• Linux Linux Kernel: before 6.6 (fixed in 6.6); version 6.6 only
• Red Hat Enterprise Linux: version 9.0 only

Published 2023-09-28. Last modified 2026-06-17.