CVE-2023-52927
HIGH 7.8 ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 24th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Affected
Products Linux Simatic S7 1500 Cpu 1518 4 Pn/Dp Mfp Simatic S7 1500 Cpu 1518f 4 Pn/Dp Mfp Simatic S7 1500 Tm Mfp Gnu/Linux Subsystem Siplus S7 1500 Cpu 1518 4 Pn/Dp Mfp Linux Kernel Debian Linux
Weakness (CWE)
- CWE-416: Use after free
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-doc as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-doc
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
perf as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/perf
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-debug as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-kdump-devel
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-doc
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-tools as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-tools
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
bpftool as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/bpftool
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-cross-headers as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-cross-headers
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-modules-internal
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-devel
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-rt-kvm as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-kvm
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-selftests-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-selftests-internal
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
python3-perf as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-perf
- workaround: To mitigate this issue, prevent module nf_conntrack from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
- no fix planned: Out of support scope
kernel as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-modules
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-debug-uki-virt as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-uki-virt
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-64k-debug-devel as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug-devel
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-uki-virt
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00python3-perf as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-perf
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-core
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-cross-headers as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-cross-headers
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-devel as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-core
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-devel-matched
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-rt-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-partner
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00kernel-zfcpdump-devel-matched as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel-matched
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00rv as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rv
Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
2 candidates
- https://github.com/seadragnol/CVE-2023-52927PoC-in-GitHub · CVE-2023-52927
PoC-in-GitHub · CVE-2023-52927 · Updated 2025-08-19T17:21:09Z - https://github.com/HoangNhoo/Reproduce-CVE-2023-52927PoC-in-GitHub · CVE-2023-52927
PoC-in-GitHub · CVE-2023-52927 · Updated 2026-09-06T16:54:46Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 5.18 and < 6.1.130 |
| Linux | Linux Kernel | ≥ 6.2 and < 6.6 |
| Debian | Debian Linux | 11.0 |
All CVSS metrics
- HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://seadragnol.github.io/posts/CVE-2023-52927/ CVE record · Linux · Updated 2026-08-05T09:12:05.687Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570
Advisories
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html CVE record · CVE · Updated 2025-11-03T19:28:52.085Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52927.json Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59682 EUVD · EUVD-2023-59682
Technical & other
- https://git.kernel.org/stable/c/3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec CVE record · Linux · Updated 2026-08-05T09:12:05.687Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://git.kernel.org/stable/c/4914109a8e1e494c6aa9852f9e84ec77a5fc643f CVE record · Linux · Updated 2026-08-05T09:12:05.687Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE record · siemens-SADP · Updated 2026-10-15T00:17:11.022Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE record · siemens-SADP · Updated 2026-10-15T00:17:11.022Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://cert-portal.siemens.com/productcert/html/ssa-457936.htmlCVE record · siemens-SADP · Updated 2026-10-15T00:17:11.022Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://cert-portal.siemens.com/productcert/html/ssa-784472.htmlCVE record · siemens-SADP · Updated 2026-10-15T00:17:11.022Z
NVD · CVE-2023-52927 · Updated 2026-10-15T01:17:16.570 - https://access.redhat.com/security/cve/CVE-2023-52927 Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2352567 Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
- https://www.cve.org/CVERecord?id=CVE-2023-52927 Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2023-52927 Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
- https://lore.kernel.org/linux-cve-announce/2025031432-CVE-2023-52927-b600@gregkh/T Red Hat · CVE-2023-52927 · Updated 2026-08-04T19:23:44+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS