CVE-2023-6622

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/errata/RHSA-2024:2394Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2950Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3138Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-6622Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2253632Issue Tracking, Patch
https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72beaPatch
https://access.redhat.com/errata/RHSA-2024:2394Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2950Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3138Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-6622Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2253632Issue Tracking, Patch
https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72beaPatch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAOVK2F3ALGKYIQ5IOMAYEC2DGI7BWAW/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G3AGDVE3KBLOOYBPISFDS74R4YAZEDAY/Third Party Advisory

Timeline

Published: Dec 8, 2023
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-66239.8The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when renderin CVE-2023-66245.4The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in CVE-2023-66254.3The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could all CVE-2023-66264.8The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high pr CVE-2023-66276.1The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attacke CVE-2023-66296.1The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Refl CVE-2023-66304.3The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an CVE-2023-66317.8PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary cod CVE-2023-66326.1The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and includ CVE-2023-66334.3The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make CVE-2023-66349.8The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content fun CVE-2023-66357.2The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' funct