CVE-2023-6931: heap overflow in Linux kernel and privilege escalation

Heap overflow in Linux kernel enables local privilege escalation. CVSS 7.8 high, patch available.

CVE-2023-6931 is a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events component. An overflow of the read_size parameter in a perf_event causes an out-of-bounds write or increment in the perf_read_group() function. The flaw affects local Linux systems and allows unprivileged users to execute arbitrary code with kernel privileges, achieving local privilege escalation.

The vulnerability was assigned CVSS 7.8, falling into the High category. It was disclosed on 2023-12-19 and a fix was proposed via commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. Recently (2026-11-08), a public repository was identified declaring an exploit port for kernel 4.19.157-perf on specific hardware, indicating practical interest in exploiting the flaw.

To defend: 1) Verify your kernel version and consult your distributor (Red Hat, Canonical, Debian, etc.) for available patches. 2) Apply kernel updates as soon as they become available. 3) Restrict local access to critical systems and audit access controls. 4) Monitor system logs for privilege escalation attempts, particularly unusual perf component activity.

At a glance

What: Heap out-of-bounds write vulnerability in the Linux kernel's Performance Events component. An overflow of a perf_event's read_size value causes an out-of-bounds write or increment in perf_read_group(). Affects local Linux systems and can enable privilege escalation.
Severity: CVSS 7.8 (High). Enables local privilege escalation with local system access.
Affected versions: Not reported in NVD. The technical signal concerns the Performance Events component of the Linux kernel in general. Public exploit activity detected on kernel 4.19.157-perf on specific hardware.
Fix: Update past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. Verify with your kernel distributor or Linux distribution vendor for available patches.
Status: CVE published 2023-12-19. A public repository has been identified declaring an exploit port for kernel 4.19.157-perf on specific hardware (Hisense HITV205N TV), detected 2026-11-08.
Action: 1) Verify your kernel version and consult your distributor (Red Hat, Canonical, Debian, etc.) for patch availability. 2) Apply kernel updates as soon as they become available. 3) Restrict local access to critical systems and audit access controls. 4) Monitor system logs for privilege escalation attempts.

Sources: NVD, CVE-2023-6931

← All articles