CVE-2023-52927
netfilter: allow exp not to be removed in nf_ct_find_expectation
HIGH 7.8EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved:netfilter: allow exp not to be removed in nf_ct_find_expectationCurrently nf_conntrack_in() calling nf_ct_find_expectation() willremove the exp from the hash table. However, in some scenario, weexpect the exp not to be removed when the created ct will not beconfirmed, like in OVS and TC conntrack in the following patches.This patch allows exp not to be removed by setting IPS_CONFIRMEDin the status of the tmpl.
- Affected
- Linux
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.32% chance of exploitation in the next 30 days, 23rd percentile
- Published
- 2025-03-14
- Updated
- 2026-10-15
Proof-of-concept exploits (2)
- HoangNhoo/Reproduce-CVE-2023-529272★ · 2025-09-29
- seadragnol/CVE-2023-529279★ · 2025-07-07
Exploit collections (1)
- linux/kernelctf/CVE-2023-52927_cosgoogle/security-research