Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-26606: Linux kernel 6.0.8 may free memory too early, causing crash

CVE-2023-26606 · published 3 years ago

Summary

The Linux kernel version 6.0.8 contains a coding error in its NTFS file‑system driver that can free memory while it is still in use. This mistake could allow an attacker to trigger a system crash or run unwanted code. Install a newer kernel release or apply the available security patch to fix the issue.

What to do

Update debian linux to version 6.1.4-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	linux	< 6.1.4-1 Fix: upgrade to 6.1.4-1
Debian:13	debian	linux	< 6.1.4-1 Fix: upgrade to 6.1.4-1
Debian:14	debian	linux	< 6.1.4-1 Fix: upgrade to 6.1.4-1
–	linux	linux_kernel	>= 5.15, < 5.15.86 >= 5.16, < 6.0.16 >= 6.1, < 6.1.2 `cpe:2.3:o:linux:linux_kernel::::::::`

Original advisory text

In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c.

References

https://security-tracker.debian.org/tracker/CVE-2023-26606 Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=557d1... URL
https://lkml.org/lkml/2023/2/20/860 URL
https://security.netapp.com/advisory/ntap-20230316-0010/ Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26606... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-26606 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published26 Feb 2023

Updated4 Nov 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-26606 · OSV

CVE-2023-26606 · NVD

CVE-2023-26606 · OSV

Track software like this

Free during beta