Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2023-3773
Red Hat Red Hat Enterprise Linux 9 — Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L H N U H N N 4.4 .0025 15.5 —
AFFECTED
Product Versions Fixed
Red Hat Enterprise Linux 9 unspecified 0:5.14.0-362.8.1.el9_3
Red Hat Enterprise Linux 9 unspecified 0:5.14.0-362.8.1.el9_3
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
TIMELINE
Jul 19 Reserved by redhat
Jul 25 Published (CNA: redhat)
Oct 14 RESCORED — CVE-2023-3773 (Red Hat Enterprise Linux 9). CVSS 5.5 → 4.4 (NVD).
Description
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 19, 2023 | Reserved | Reserved by redhat |
| July 25, 2023 | Published | Published (CNA: redhat) |
| October 14, 2026 | RESCORED | RESCORED — CVE-2023-3773 (Red Hat Enterprise Linux 9). CVSS 5.5 → 4.4 (NVD). |
Affected
Affected products and packages — 8 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:5.14.0-362.8.1.el9_3 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:5.14.0-362.8.1.el9_3 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-3773 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
