{"id":"CVE-2023-6622","title":"Kernel: null pointer dereference vulnerability in nft_dynset_init()","summary":"A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Red Hat","product":"kernel-rt","affected":["kernel-rt (all versions)","kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel","kernel","kernel-rt","kernel-rt (all versions)"],"published":"2023-12-08","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:37:23.528Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-6622","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2394","label":"RHSA-2024:2394"},{"url":"https://access.redhat.com/errata/RHSA-2024:2950","label":"RHSA-2024:2950"},{"url":"https://access.redhat.com/errata/RHSA-2024:3138","label":"RHSA-2024:3138"},{"url":"https://access.redhat.com/security/cve/CVE-2023-6622"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253632","label":"RHBZ#2253632"},{"url":"https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72bea"}],"tags":["cve.org"],"epss":0.00321,"epssPercentile":0.25281,"ingestedAt":"2026-11-05T21:36:00.810Z","slug":"CVE-2023-6622","body":"## Overview\n\nA null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.\n\n## Affected\n\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel`\n- `kernel`\n- `kernel-rt`\n- `kernel-rt (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is to skip loading the affected module \"netfilter\" onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time.\n~~~\nHow do I blacklist a kernel module to prevent it from loading automatically?\nhttps://access.redhat.com/solutions/41278","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}