CVE-2023-31248: (Pwn2Own) Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
Last updated 18 March 2026
Other sources
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nftchainlookupbyid() failed to check whether a chain was active and CAPNETADMIN is in any user or network namespace
— Launchpad
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of nftchains. The issue results from the lack of validating the status of a chain while processing lookup on the chain. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Mitigation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31248?
CVE-2023-31248 is considered a high severity local privilege escalation vulnerability.
How do I fix CVE-2023-31248?
To mitigate CVE-2023-31248, update to a patched version of the Linux kernel, such as 5.10.223-1 or 6.1.123-1.
Which versions of the Linux kernel are affected by CVE-2023-31248?
CVE-2023-31248 impacts Linux kernel versions between 5.9 and 6.4.4, including specific distributions like Fedora and Ubuntu.
Can CVE-2023-31248 be exploited remotely?
CVE-2023-31248 requires local access for exploitation, meaning an attacker must have local user capabilities.
What does the CVE-2023-31248 vulnerability involve?
CVE-2023-31248 involves a use-after-free condition in the nftables subsystem of the Linux kernel that could lead to privilege escalation.