CVE-2023-6200

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	kernel	—
n/a	kernel	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Virtualization 4	—
Fedora	Fedora	—

References

https://access.redhat.com/security/cve/CVE-2023-6200Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2250377Issue Tracking, Patch
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dade3f6a1e4eMailing List, Patch
https://access.redhat.com/security/cve/CVE-2023-6200Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2250377Issue Tracking, Patch
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dade3f6a1e4eMailing List, Patch

Timeline

Published: Jan 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62018.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama CVE-2023-62024.3Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user a CVE-2023-62037.5The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted CVE-2023-62046.5On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the CVE-2023-62056.5It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.CVE-2023-62065.4The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible CVE-2023-62078.8Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and CVE-2023-62088.8When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not CVE-2023-62096.5Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th CVE-2023-62106.5When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifr CVE-2023-62116.5If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked CVE-2023-62128.8Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption