CVE-2023-6040: High Netfilter Out-of-Bounds Access in Linux Kernel

CVE-2023-6040 is a high severity (CVSS 7.8) out-of-bounds access in the Linux kernel netfilter nf_tables code. Creating a table with an invalid address family value was not checked. The oss-security post says it affects the upstream 5.4, 5.10 and 5.15 stable lines, and that kernels newer than 5.18-rc1 are safe.

What's affected

• Product: Linux kernel, netfilter nf_tables, in the nf_tables_newtable function.
• Affected: upstream stable 5.4.y, 5.10.y and 5.15.y, which need the fix applied. Any upstream kernel newer than 5.18-rc1 should be safe, per the oss-security post.
• Fix: upstream commit f1082dd31fe4, titled netfilter: nf_tables: Reject tables of unsupported family. Distribution kernels carry it under their own version numbers.
• Severity: 7.8 High (local attack, low privileges).
• Mitigation named in the advisory: disabling unprivileged user namespaces.

How to check if you're exposed

Start with the running kernel and your distribution's security tracker, because vendors backport the fix without changing the upstream version number:

uname -r
# Debian and Ubuntu: look for the CVE in the changelog of the installed kernel
apt changelog linux-image-$(uname -r) | grep -i CVE-2023-6040
# RPM based systems
rpm -q --changelog kernel | grep -i CVE-2023-6040

If the changelog of the installed kernel mentions the CVE, the fix is present. Also check whether unprivileged user namespaces are enabled, since the advisory ties the mitigation to them:

sysctl user.max_user_namespaces

For container hosts, scan the host kernel too, not just the images. Container images share the host kernel, so an image scan does not tell you about this CVE.

What to do now

1. Install your distribution's kernel update that includes the fix for CVE-2023-6040, and reboot, or apply a live patch if your vendor provides one.
2. Confirm after reboot that the running kernel version matches the patched package.
3. If you cannot patch yet, consider disabling unprivileged user namespaces as the advisory suggests. Test first, because rootless containers and some sandboxes rely on them.
4. Prioritize multi-user systems, container hosts and CI runners, where untrusted local code may run.
5. Track kernel versions in your asset inventory, since the kernel is not visible in application lockfiles.

Why it matters

The nf_tables code accepts a protocol family value when a table is created and did not reject unsupported values. The advisory describes two places where that invalid value is later used as an array index, in x_tables.c and in nf_log.c, with no boundary check. The weakness class is CWE-125, out-of-bounds read, which the advisory says can be turned into further access.

Creating nf_tables objects normally needs the CAP_NET_ADMIN capability, and unprivileged user namespaces can grant that inside a namespace. That is why the advisory names them as the mitigation. The bug was reported to Ubuntu Security by Lin Ma of Ant Security Light-Year Lab. The record does not list the CVE as known exploited. A local attacker is the model here, so shared hosts and container platforms carry the most risk.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CVE-2023-6040 on Gold
• oss-security: CVE-2023-6040 netfilter out-of-bounds access

Last reviewed: 19 October 2026.