CVE-2023-6531 is a high severity use-after-free in the Linux kernel. A race between the unix socket garbage collector deleting a queued buffer and unix_stream_read_generic can free memory still in use. The record scores it 7.0. Install the kernel update from your vendor and reboot.
What's affected
- Component: the Linux kernel, unix domain socket garbage collection.
- Affected: the record lists the Linux kernel generally, including 6.7 release candidates, and Red Hat Enterprise Linux 9.0.
- Fixed: see Red Hat errata RHSA-2024:2394 and the upstream patch linked in the record. This post does not name a kernel version.
- Access needed: local, low privileges, high complexity.
The record gives a CVSS 3.1 base score of 7.0 (high) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
uname -r
rpm -q --changelog kernel | grep -i CVE-2023-6531
On Red Hat family systems the changelog search shows whether the installed kernel build includes the fix. On other distributions, use the distribution security tracker for the kernel package name and compare with your running kernel.
What to do now
- Inventory running kernel versions across servers, containers hosts and workstations.
- Install the kernel update that names CVE-2023-6531 and reboot.
- Prioritise multi-user systems and container hosts, where untrusted local code is more likely to run.
- Confirm the new kernel is the one running after the reboot.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-362 (Race Condition): Two code paths touch the same resource at the same time without proper synchronisation, so the outcome depends on timing.
The record classes the flaw as a race condition. Two parts of the kernel act on the same buffer at nearly the same time, one freeing it and one reading it. The result is a use-after-free, a memory safety bug that can crash a system or be developed further by someone with local access.
The attack needs a local account and a precisely timed race, which is why the score is 7.0 and not higher. Even so, local privilege escalation bugs matter on shared hosts, CI runners and container nodes, where code from outside your team runs next to everything else.
Try it yourself
This demo shows continuous monitoring, which is how a new advisory gets matched to hosts you already inventoried.
Click through it at your own pace, or open it full screen.
Quick check
Is a reboot required?
Yes, unless your vendor supports live patching for this fix. Check the running kernel with uname -r afterward.
Can this be exploited remotely?
The vector is local. An attacker needs to run code on the host first.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- lore.kernel.org
- packetstormsecurity.com
- Gold entry for CVE-2023-6531
Last reviewed: 19 October 2026.
