---
id: CVE-2023-5633
title: >-
  Kernel: vmwgfx: reference count issue leads to use-after-free in surface
  handling
summary: >-
  The reference count changes made as part of the CVE-2023-33951 and
  CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects
  were handled when they were being used to store a surface. When running inside
  a VMware guest…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-911
vendor: Red Hat
product: kernel-rt
affected:
  - kernel-rt (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel-rt (all versions)
  - kernel
  - kernel
  - kernel-rt
  - kernel-rt (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-05-10T04:00:11.958257Z'
published: '2023-10-23'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:06:09.699Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-5633'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:0113'
    label: 'RHSA-2024:0113'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0134'
    label: 'RHSA-2024:0134'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0461'
    label: 'RHSA-2024:0461'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1404'
    label: 'RHSA-2024:1404'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4823'
    label: 'RHSA-2024:4823'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4831'
    label: 'RHSA-2024:4831'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-5633'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245663'
    label: RHBZ#2245663
tags:
  - cve.org
epss: 0.00278
epssPercentile: 0.20375
ingestedAt: '2026-11-05T21:36:00.591Z'
---

## Overview

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

## Affected

- `kernel-rt (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel-rt (all versions)`
- `kernel`
- `kernel`
- `kernel-rt`
- `kernel-rt (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

This flaw can be mitigated by turning off 3D acceleration in VMware (if possible) or preventing the affected `vmwgfx` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.