CVE-2023-3812

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

HIGH

7.8

CVSS Score

Published: July 24, 2023 at 03:19 PM UTC

Updated: June 17, 2026 at 06:14 AM UTC

2 products affected across 2 vendorsLinux KernelEnterprise Linux

Using Red Hat Enterprise Linux 8 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 8 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.15 ≤ v < 4.19.2654.20 ≤ v < 5.4.2245.11 ≤ v < 5.15.785.16 ≤ v < 6.0.85.5 ≤ v < 5.10.154

Affected range stops below 4.19.265, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.10.154, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.15.78, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.4.224, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.8, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

95%

8.0 9.0

Vendor states this is fixed in 0:4.18.0-193.133.1.el8_2 (unaffected)

Vendor states this is fixed in 0:4.18.0-193.133.1.rt13.184.el8_2 (unaffected)

Vendor states this is fixed in 0:4.18.0-305.120.1.el8_4 (unaffected)

Vendor states this is fixed in 0:4.18.0-305.120.1.rt7.196.el8_4 (unaffected)

Vendor states this is fixed in 0:4.18.0-372.87.1.el8_6 (unaffected)

Vendor states this is fixed in 0:4.18.0-477.43.1.el8_8 (unaffected)

Vendor states this is fixed in 0:4.18.0-513.9.1.el8_9 (unaffected)

Vendor states this is fixed in 0:4.18.0-513.9.1.rt7.311.el8_9 (unaffected)

Vendor states this is fixed in 0:5.14.0-284.40.1.el9_2 (unaffected)

Vendor states this is fixed in 0:5.14.0-284.40.1.rt14.325.el9_2 (unaffected)

Vendor states this is fixed in 0:5.14.0-362.18.1.el9_3 (unaffected)

Vendor states this is fixed in 0:5.14.0-70.80.1.el9_0 (unaffected)

Vendor states this is fixed in 0:5.14.0-70.80.1.rt21.151.el9_0 (unaffected)

Vendor states this is fixed in 6 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Vendor states this is fixed in 8 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references