CVE-2023-52996: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in fib_metrics_match() if (!type) continue; if (type > RTAX_MAX) return false; ... fi_val = fi->fib_metrics->metrics[type - 1]; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.

Affected products

• Linux Linux Kernel: from 4.14, before 5.4.231 (fixed in 5.4.231); from 5.5, before 5.10.166 (fixed in 5.10.166); from 5.11, before 5.15.91 (fixed in 5.15.91); from 5.16, before 6.1.9 (fixed in 6.1.9); version 6.2 only

Published 2025-03-27. Last modified 2026-06-17.