{"id":"CVE-2023-2236","summary":"Use-after-free in Linux kernel's Performance Events subsystem","details":"A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.\n\nBoth io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability.\n\nWe recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.","modified":"2026-08-12T03:51:44.614278210Z","published":"2023-05-01T12:50:47.742Z","database_specific":{"cna_assigner":"Google","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2236.json"},"references":[{"type":"WEB","url":"https://git.kernel.org"},{"type":"WEB","url":"https://kernel.dance/9d94c04c0db024922e886c9fd429659f22f48ea4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2236.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2236"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230601-0010/"},{"type":"FIX","url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d94c04c0db024922e886c9fd429659f22f48ea4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git","events":[{"introduced":"3d7cb6b04c3f3115719235cc6866b10326de34cd"},{"fixed":"830b3c68c1fb1e9176028d02ef86f3cf76aa2476"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"5.19"},{"fixed":"6.1"}]}}],"versions":["v6.1-rc1","v6.1-rc8","v6.1-rc3","v6.1-rc6","v6.1-rc7","v6.1-rc4","v6.1-rc2","v6.1-rc5","v6.0-rc1","v6.0","v6.0-rc7","v6.0-rc3","v6.0-rc2","v6.0-rc6","v6.0-rc4","v6.0-rc5","v5.19"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2236.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}