PatchTheCEVCVE-2023-6915: A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel
31
Routine
MEDIUM 6.2WATCHLISTMITIGATEDOWNGRADEDOWNGRADE
CVE-2023-6915 is a medium-severity flaw (CVSS 6.2) affecting debian linux, codeready linux builder, codeready linux builder for arm64. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.2 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-476 |
| Published | 2024-01-15 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
debian debian linux MITIGATE
Affected: 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
redhat codeready linux builder DOWNGRADE
Affected: 8.0 · 9.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
1. Check installed version
apt-cache policy codeready-linux-builder || rpm -q codeready-linux-builder || codeready-linux-builder --version
2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)
apt-cache madison codeready-linux-builder
sudo apt install codeready-linux-builder=<VERSION_BEFORE_8.0>
sudo apt-mark hold codeready-linux-builder
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list codeready-linux-builder
sudo dnf downgrade codeready-linux-builder-<VERSION_BEFORE_8.0>
sudo dnf versionlock add codeready-linux-builder
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat codeready linux builder for arm64 DOWNGRADE
Affected: 8.0_aarch64
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0_aarch64
1. Check installed version
apt-cache policy codeready-linux-builder-for-arm64 || rpm -q codeready-linux-builder-for-arm64 || codeready-linux-builder-for-arm64 --version
2. No fixed release: DOWNGRADE to a release before 8.0_aarch64 (Debian / Ubuntu)
apt-cache madison codeready-linux-builder-for-arm64
sudo apt install codeready-linux-builder-for-arm64=<VERSION_BEFORE_8.0_aarch64>
sudo apt-mark hold codeready-linux-builder-for-arm64
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list codeready-linux-builder-for-arm64
sudo dnf downgrade codeready-linux-builder-for-arm64-<VERSION_BEFORE_8.0_aarch64>
sudo dnf versionlock add codeready-linux-builder-for-arm64
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat codeready linux builder for power little endian DOWNGRADE
Affected: 8.0 · 9.0_ppc64le
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
1. Check installed version
apt-cache policy codeready-linux-builder-for-power-little-endian || rpm -q codeready-linux-builder-for-power-little-endian || codeready-linux-builder-for-power-little-endian --version
2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)
apt-cache madison codeready-linux-builder-for-power-little-endian
sudo apt install codeready-linux-builder-for-power-little-endian=<VERSION_BEFORE_8.0>
sudo apt-mark hold codeready-linux-builder-for-power-little-endian
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list codeready-linux-builder-for-power-little-endian
sudo dnf downgrade codeready-linux-builder-for-power-little-endian-<VERSION_BEFORE_8.0>
sudo dnf versionlock add codeready-linux-builder-for-power-little-endian
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat codeready linux builder for power little endian els DOWNGRADE
Affected: 8.10
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.10
1. Check installed version
apt-cache policy codeready-linux-builder-for-power-little-endian-els || rpm -q codeready-linux-builder-for-power-little-endian-els || codeready-linux-builder-for-power-little-endian-els --version
2. No fixed release: DOWNGRADE to a release before 8.10 (Debian / Ubuntu)
apt-cache madison codeready-linux-builder-for-power-little-endian-els
sudo apt install codeready-linux-builder-for-power-little-endian-els=<VERSION_BEFORE_8.10>
sudo apt-mark hold codeready-linux-builder-for-power-little-endian-els
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list codeready-linux-builder-for-power-little-endian-els
sudo dnf downgrade codeready-linux-builder-for-power-little-endian-els-<VERSION_BEFORE_8.10>
sudo dnf versionlock add codeready-linux-builder-for-power-little-endian-els
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat enterprise linux MITIGATE
Affected: 8.0 · 9.0 · 9.4 · 9.6 · 9.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Ubuntu 24.04 · linux · NOT AFFECTED
Ubuntu 20.04 · linux · FIXED · 5.4.0-172.190
sudo apt update && sudo apt install --only-upgrade linux
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' linux)" ge "5.4.0-172.190" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · linux · FIXED · 5.15.0-97.107
sudo apt update && sudo apt install --only-upgrade linux
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' linux)" ge "5.15.0-97.107" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.10 · linux · NOT AFFECTED
Ubuntu 25.04 · linux · NOT AFFECTED
Debian 12 · linux · FIXED · 6.1.76-1
sudo apt update && sudo apt install --only-upgrade linux
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' linux)" ge "6.1.76-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · linux · FIXED · 6.6.13-1
sudo apt update && sudo apt install --only-upgrade linux
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' linux)" ge "6.6.13-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 8 · kernel-rt · FIXED · kernel-rt-4.18.0-553.rt7.342.el8_10
sudo dnf upgrade --advisory=RHSA-2024:2950
rpm -q kernel-rt
RHEL 8 · kernel · FIXED · kernel-4.18.0-553.el8_10
sudo dnf upgrade --advisory=RHSA-2024:3138
rpm -q kernel
RHEL 9 · kernel · FIXED · kernel-5.14.0-427.13.1.el9_4
sudo dnf upgrade --advisory=RHSA-2024:2394
rpm -q kernel
RHEL 6 · kernel · NOT AFFECTED
RHEL 7 · kernel · NOT AFFECTED
sudo dnf update --advisory=ALAS2023-2024-519
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2023-4050 HIGH 7.5 UPGRADE MITIGATE In some cases, an untrusted input stream was copied to a stack buffer without checking its size
- CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p
- CVE-2023-28321 MEDIUM 5.9 UPGRADE MITIGATE An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil
- CVE-2023-23916 MEDIUM 6.5 UPGRADE MITIGATE An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch
- CVE-2023-4049 MEDIUM 5.9 UPGRADE MITIGATE Race conditions in reference counting code were found through code inspection