Back to Database
Status published
Low
CVE-2023-39194
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
Vulnerability Description
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39194
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHSA-2024:2394
- https://access.redhat.com/errata/RHSA-2024:2950
- https://access.redhat.com/errata/RHSA-2024:3138
- https://access.redhat.com/security/cve/CVE-2023-39194
- https://bugzilla.redhat.com/show_bug.cgi?id=2226788
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-18111/
More from Red Hat
View All →CVE-2025-9909
Aap-gateway: improper path validation in gateway allows credential exfiltration
Medium
6.7
CVE-2025-9908
Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
Medium
6.7
CVE-2025-9907
Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
Medium
6.7
CVE-2025-9901
Libsoup: improper handling of http vary header in libsoup caching
Medium
5.9
CVE-2025-9820
Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function
Medium
4
Affected Vendor
Red Hat
View all reports →Affected Software
Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Vulnerable Versions:
0:4.18.0-553.rt7.342.el8_10, 0:4.18.0-553.el8_10, 0:5.14.0-427.13.1.el9_4
Timeline
Official Publish:
October 9th, 2023
Last Modified:
November 6th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N