CVE-2023-26607: linux linux_kernel Out-of-bounds Read
CVSS: 7.1v3.1HighModified
AliasesUBUNTU-CVE-2023-26607DEBIAN-CVE-2023-26607
Published 26-02-2023Last modified 14-10-2026
Vulnerability summary
CVE-2023-26607 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux linux_kernel. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.1/10
010
High · v3.1 (CVE.org)EPSS score
0.61%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 8 · Related 8Timeline
- 26-02-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 21-09-2026
21-09-202621-10-2026
EPSS score0.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (lkml.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu90 products
- linuxAll versions (No fix recorded) | < 4.4.0-239.273 | < 4.15.0-206.217 | < 5.4.0-144.161 | < 5.15.0-67.74
- linux-aws< 4.4.0-1117.123 | < 4.4.0-1155.170 | < 4.15.0-1151.164 | < 5.4.0-1097.105 | < 5.15.0-1031.35
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Debian1 product
- linux< 4.19.37-1
Linux1 product
- linux_kernel≥ 2.6.12, < 4.9.334 | ≥ 4.10, < 4.14.300 | ≥ 4.15, < 4.19.267 | ≥ 4.20, < 5.4.225 | ≥ 5.5.0, < 5.10.156 | ≥ 5.11, < 5.15.80 | ≥ 5.16, < 6.0.10
Netapp1 product
- hci_baseboard_management_controllerh300s | h410c | h410s | h500s | h700s
4 vendors · 93 products
References
18 links- security.netapp.com/advisory/ntap-20230316-0010/Third Party Advisory
