Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2023-1032: Linux kernel may crash using io_uring socket operation
CVE-2023-1032 · published 2 years ago
Summary
The Linux kernel used in Debian can crash when a program uses the io_uring feature to create a socket, due to a coding error that frees memory twice. This can cause the system to become unstable or stop working. Apply the latest kernel updates from your distribution to fix the issue.
What to do
- Update debian linux to version 6.1.20-1.
- Update linux linux_kernel to version 6.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | linux |
< 6.1.20-1 Fix: upgrade to 6.1.20-1
|
| Debian:13 | debian | linux |
< 6.1.20-1 Fix: upgrade to 6.1.20-1
|
| Debian:14 | debian | linux |
< 6.1.20-1 Fix: upgrade to 6.1.20-1
|
| – | linux | linux_kernel |
>= 5.19, < 6.3 6.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
22.04 22.10 cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* |
Original advisory text
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551...
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
References
- https://security-tracker.debian.org/tracker/CVE-2023-1032 Vendor Advisory
- https://ubuntu.com/security/notices/USN-5977-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6024-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6033-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1032.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-1032 Vendor Advisory
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1032 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/03/13/2 Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-415Double Free
Timeline
Published8 Jan 2024
Updated3 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta