CVE-2023-6270: High Severity Use After Free in Linux AoE Driver

CVE-2023-6270 is a High severity (CVSS 7.0) use after free in the Linux kernel's ATA over Ethernet (AoE) driver. A race on a network device structure can cause a crash or possibly code execution. Red Hat says RHEL 8 and 9 do not ship the driver, so the check is whether your kernels include it.

What's affected

Sources describe the flaw but not a clean version range.

• Affected: Linux kernels that include the AoE driver (aoecmd_cfg_pkts() is the function named). The record's product list includes the Linux kernel, Debian 10 and Fedora 39.
• Not affected: Red Hat states that RHEL 8 and 9 are not affected because the AoE driver is not included in any shipping kernel release.
• Fix: Red Hat's bug entry lists no fixed version. The NVD references include Debian LTS announcements from June 2024, which suggests Debian shipped updates for its LTS kernels. Check your distribution's tracker for the kernel build that carries the fix.
• Mitigation: Red Hat says no mitigation meeting its criteria is available.
• Severity: NVD scores 7.0 High. Red Hat's tracker lists medium priority and severity, so the sources differ.

How to check if you're exposed

The first question is whether the driver is present at all.

uname -r
lsmod | grep aoe
modinfo aoe
grep -i CONFIG_ATA_OVER_ETH /boot/config-$(uname -r)

If lsmod shows nothing and modinfo cannot find the module, the driver is not loaded or not built. A kernel that builds it as a module but never loads it is much lower risk than one that loads it for storage. AoE is a niche protocol for network attached block storage, and most servers never use it.

If you do use AoE, compare your kernel build to your distribution's security tracker for this CVE.

What to do now

1. Run the module check across your Linux fleet and list hosts where the aoe module is loaded or loadable.
2. Update the kernel on those hosts to a build that your distribution marks as fixed, and reboot.
3. On systems that do not need AoE, a common hardening step is to stop the module from loading, using a modprobe configuration. Test that first, since this is general practice and not a vendor stated mitigation for this CVE.
4. Keep AoE traffic on an isolated storage network, since the protocol has no built in authentication.
5. Document hosts that are unaffected, with the reason, so you do not recheck them every time.

Why it matters

The weakness is CWE-416, use after free. The description says the function updates a reference count on a network device structure incorrectly. A race between freeing that structure and accessing it through a global transmit queue can then leave the kernel using memory that has been released.

Use after free bugs in kernel code can lead to a crash, which is a denial of service, and in some cases to code execution. The practical risk here is limited by exposure. The driver is not part of mainstream enterprise kernels, and AoE is normally confined to a storage segment. The kev flag is false and no source I read reports exploitation. It is a good example of a CVE where a quick check of whether the component exists saves a lot of work.

Quick check

Sources

• Red Hat CVE page
• Red Hat Bugzilla 2256786

Last reviewed: 19 October 2026.