CVE-2023-1295

Privilege escalation with IO_RING_OP_CLOSE in the Linux Kernel

At a glance

Severity: HIGH 7.8
EPSS: EPSS 0.22 % · percentile 12 (2026-10-28)
State: PUBLISHED
Published: 2023-06-28
Updated: 2025-02-13
Assigner: Google
NVD status: Modified

Description

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Google
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · cve-coordination@google.com (Secondary)
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-367

European references

ENISA EUVD · EUVD-2023-23560
GCVE · GCVE-0-2023-1295

Affected configurations (NVD CPE)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.6 < 5.10.162
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.11.6
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Affected products

Product	Versions
Linux · Linux Kernel	affected 5.6 ≤ 5.11

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD