CVE-2023-2006

kernel: rxrpc: race condition between connection bundle lookup and removal

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · April 13, 2023

Updated · November 21, 2025

Description

A race condition was found in the Linux kernel's RxRPC network protocol within the processing of RxRPC bundles. This issue results from improper locking when performing operations on an object. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

Statement

Red Hat Enterprise Linux 6, 7, 8 and 9 are not affected by this flaw as they did not include support for the RxRPC network protocol (CONFIG_AF_RXRPC is not set).

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')