Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-eh5h-mkpr-byeq
Vulnerability ID VCID-eh5h-mkpr-byeq
Aliases CVE-2023-39191
Summary An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.
Status Published
Exploitability 0.5
Weighted Severity 7.4
Risk 3.7
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 8.2 https://access.redhat.com/errata/RHSA-2023:6583
ssvc Track https://access.redhat.com/errata/RHSA-2023:6583
cvssv3.1 8.2 https://access.redhat.com/errata/RHSA-2024:0381
ssvc Track https://access.redhat.com/errata/RHSA-2024:0381
cvssv3.1 8.2 https://access.redhat.com/errata/RHSA-2024:0439
ssvc Track https://access.redhat.com/errata/RHSA-2024:0439
cvssv3.1 8.2 https://access.redhat.com/errata/RHSA-2024:0448
ssvc Track https://access.redhat.com/errata/RHSA-2024:0448
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39191.json
cvssv3.1 8.2 https://access.redhat.com/security/cve/CVE-2023-39191
ssvc Track https://access.redhat.com/security/cve/CVE-2023-39191
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2023-39191
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2023-39191
cvssv3.1 8.2 https://bugzilla.redhat.com/show_bug.cgi?id=2226783
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2226783
cvssv3.1 8.2 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.2 https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
ssvc Track https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39191.json
https://api.first.org/data/v1/epss?cve=CVE-2023-39191
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2226783 https://bugzilla.redhat.com/show_bug.cgi?id=2226783
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::nfv https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/a:redhat:enterprise_linux:9::realtime https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:rhel_eus:9.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::appstream
cpe:/a:redhat:rhel_eus:9.2::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.2::nfv https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::nfv
cpe:/a:redhat:rhel_eus:9.2::realtime https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::realtime
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/o:redhat:rhel_eus:9.2::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_eus:9.2::baseos
CVE-2023-39191 https://access.redhat.com/security/cve/CVE-2023-39191
RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583
RHSA-2024:0381 https://access.redhat.com/errata/RHSA-2024:0381
RHSA-2024:0439 https://access.redhat.com/errata/RHSA-2024:0439
RHSA-2024:0448 https://access.redhat.com/errata/RHSA-2024:0448
ZDI-CAN-19399 https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2023:6583
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://access.redhat.com/errata/RHSA-2023:6583
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0381
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://access.redhat.com/errata/RHSA-2024:0381
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0439
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://access.redhat.com/errata/RHSA-2024:0439
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0448
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://access.redhat.com/errata/RHSA-2024:0448
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39191.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2023-39191
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://access.redhat.com/security/cve/CVE-2023-39191
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2226783
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2226783
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T21:50:31Z/ Found at https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
Exploit Prediction Scoring System (EPSS)
Percentile 0.0364
EPSS Score 0.00016
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:47:23.419278+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0