ZeroDay Findings
Sign inSign up

Findings

CVE-2023-3611

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

Published Jul 21, 2023 · updated Oct 14, 2026 · Linux Kernel

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 21, 2023 · NIST NVD

    Detected

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Affected

  • cpe debian/debian linux10.0
  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel6.5
  • vendor Linux Kernelversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2023-3611

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes wit

    vulnerability.circl.lu
  • CVE.orgCVE-2023-3611

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-3611

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2023-3611

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes wi

    nvd.nist.gov

References

CVE-2023-3611 · ZeroDay Findings