{"id":"CVE-2023-1476","aliases":["EUVD-2023-23724","GHSA-rccq-5462-rgcj","RHSA-2023:1659"],"status":"published","title":"Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00232,"percentile":0.14125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-416"],"published":"2023-11-03T08:07:00Z","modified":"2026-10-28T02:31:09Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_10_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-4.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_10_1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-4.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_10_1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-4.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_13_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-2.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_13_1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-2.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_13_1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-2.el8_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-6.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_3_1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-6.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kpatch-patch-4_18_0-425_3_1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-6.el8"}]}],"bundled":4}],"products":[{"vendor":"linux","product":"linux_kernel"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:1659","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1476","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176035","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","report"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=97113eb39fa7972722ff490b947d8af023e1f6a2","tags":["x_transferred","Mailing List","Patch","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1476","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rccq-5462-rgcj"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1476.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163379","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1659.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4378","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-avoid-integer-type-confusion-in-get_proc_long.patch","tags":["article"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-proc_skip_spaces-shouldn-t-think-it-is-working-on-c-strings.patch","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/178","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0266","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=56b88b50565cd8b946a2d00b0c83927b7ebb055e","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0386","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1476","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-1476","title":"Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","status":"published","published":"2023-11-03T08:07:00.493Z","modified":"2025-02-27T20:34:44.63Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2023-23724","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","status":"published","published":"2023-11-03T08:07:00Z","modified":"2025-02-27T20:34:44Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:21.469581Z"}],"ghsa":[{"id":"GHSA-rccq-5462-rgcj","title":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting...","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","status":"published","published":"2023-11-03T09:32:49Z","modified":"2023-11-22T05:04:28Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:04.479575Z"}],"nvd":[{"id":"CVE-2023-1476","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","status":"published","published":"2023-11-03T09:15:13.393Z","modified":"2026-06-17T05:28:02.947Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-1476","title":"Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222","description":"A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.","status":"published","published":"2023-11-03T08:07:00.493Z","modified":"2026-10-28T02:31:09.022271963Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"RHSA-2023:1659","title":"Red Hat Security Advisory: kpatch-patch security update","status":"published","published":"2024-09-16T11:11:16Z","modified":"2026-08-07T10:08:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"}]}}