Dashboard / CVE-2023-3106

CVE-2023-3106

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 38/100
Published: 2023-07-12 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Unchanged
C: Low
I: Low
A: High

Description

A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
fedoraproject fedora 38
linux linux_kernel 3.15 – 3.16.39
linux linux_kernel 4.8
linux linux_kernel 4.8
linux linux_kernel 4.8
linux linux_kernel 4.8
linux linux_kernel 4.8
linux linux_kernel 4.8

References & Advisories (3)

https://bugzilla.redhat.com/show_bug.cgi?id=2221501
Issue Tracking Patch Third Party Advisory

Bug Bounty Relevance

38 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

6.6 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

EPSS — Exploitation Probability

0.29%
Raw Score 0.002920
Percentile 22.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00292
2026-11-12
0.00292
2026-11-10
0.00292
2026-11-09
0.00292
2026-11-08
0.00292
2026-11-07
0.00300
2026-11-06
0.00292

Intelligence Sources

mitre ref →
nvd ref →

External Links