CVE-2023-39190
kernel: sch_qfq: net scheduler out-of-bounds write in qfq_update_agg()
Severity
UnknownRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 9, 2023
Updated · November 21, 2025
Description
[REJECTED CVE] An array index out-of-bounds write access was found in the Linux kernel in the qfq_update_agg() function, which belongs to the net scheduler QFQ (Quick Fair Queueing Plus). This flaw requires CAP_NET_ADMIN to be exploited and could lead to local privilege escalation.
Statement
This flaw was found to be a duplicate of CVE-2023-31436. Please see https://access.redhat.com/security/cve/CVE-2023-31436 for information about affected products and security errata.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:N
CWE-787 · Out-of-bounds Write