CVE-2023-6040: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)
Vulnerability summary
CVE-2023-6040 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 26 · Related 20Timeline
- 12-01-2024PublishedVulnerability first disclosed.
- 17-06-2025Last modifiedVulnerability information updated.
Description
An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.31% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu101 products
- linux< 5.4.0-170.188 | < 5.15.0-92.102
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.4.0-1117.127 | < 5.15.0-1052.57
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 5.18.2-1
- debian_linuxEOL10.0
Linux1 product
- linux_kernel≥ 4.16, < 4.19.305 | ≥ 4.20, < 5.4.267 | ≥ 5.5, < 5.10.208 | ≥ 5.11, < 5.15.147 | ≥ 5.16, < 5.18
The linux kernel organization1 product
- linux< 5.18-rc1
4 vendors · 105 products
References
18 links- packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.htmlThird Party AdvisoryVDB Entry
