CVE-2023-4611

MediumCVSS 6.3/10Last modified Sep 11, 2026

Description

A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Kernel	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Fedora	Fedora	—

References

https://access.redhat.com/security/cve/CVE-2023-4611Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2227244Issue Tracking, Patch, Third Party Advisory
https://www.spinics.net/lists/stable-commits/msg310136.htmlMailing List, Patch
https://access.redhat.com/security/cve/CVE-2023-4611Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2227244Issue Tracking, Patch, Third Party Advisory
https://www.spinics.net/lists/stable-commits/msg310136.htmlMailing List, Patch

Timeline

Published: Aug 29, 2023
Last modified: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-461155.5Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri cod CVE-2023-461168.8Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to versio CVE-2023-461178.8reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding o CVE-2023-461184.9RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for d CVE-2023-461197.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading CVE-2023-46129.8Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Auth CVE-2023-461207.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was CVE-2023-461213.7yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbi CVE-2023-461227.1sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. Thi CVE-2023-461235.3jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specificati CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the CVE-2023-461256.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the