CVE-2023-54243: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54243 is a use-after-free vulnerability in the Linux kernel's netfilter ebtables subsystem, specifically in the ebt_do_table / table blob handling code. The bug occurs because find_table_lock() can return a valid table pointer with a non-zero (error) return code, causing table->private to be updated with a new blob that is then immediately freed by the caller, resulting in a use-after-free condition. It affects Linux kernel versions from approximately 3.15 up to the patched stable releases (5.10.173, 5.15.100, 6.1.18, 6.2.5, and 6.3). The vulnerability was published on December 30, 2025, and has an EPSS score of 0.00018 (very low probability of exploitation) (Feedly, EUVD).

The root cause is a use-after-free (CWE-416) in net/bridge/netfilter/ebtables.c. The function find_table_lock() can return a valid table pointer while simultaneously setting the ret variable to a non-zero error code. The caller interprets the non-zero ret as a failure and frees the newly allocated table blob, but table->private has already been updated to point to it — leaving a dangling pointer. Syzbot detected this via KASAN, reporting a vmalloc-out-of-bounds read in __ebt_unregister_table() during network namespace cleanup. Patches are available in the Linux stable tree across multiple branches (Feedly, Kernel Patch).

Successful exploitation of this use-after-free could allow a local attacker with sufficient privileges to manipulate freed kernel memory, potentially leading to kernel crashes (denial of service) or, in more sophisticated scenarios, privilege escalation or arbitrary kernel code execution. The vulnerability is triggered in the network namespace cleanup path (cleanup_net workqueue), meaning it can manifest during normal system operations such as container teardown. The primary risk is system instability or local privilege escalation on affected Linux systems (Feedly).

The Linux kernel stable team has released patches across multiple stable branches. The fix ensures that an error is not returned after table->private has already been updated, preventing the premature freeing of the blob. Patched versions include Linux 5.10.173, 5.15.100, 6.1.18, 6.2.5, and 6.3. Administrators should update to a patched kernel version as soon as possible. SUSE has also released updated kernel packages addressing this issue. As a temporary workaround where patching is not immediately possible, restricting unprivileged access to network namespaces and ebtables can reduce exposure (Feedly, Linux Security).