What is the CVSS score of CVE-2023-6931?

CVE-2023-6931 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Linux Kernel are affected by CVE-2023-6931?

Linux kernel's Performance Events subsystem contains a local privilege escalation vulnerability (CVE-2023-6931) enabling unprivileged users to escalate to kernel level, creating acute risk for…. A patch is available.

How to fix or mitigate CVE-2023-6931?

Within 24 hours, inventory all Linux systems by kernel version to identify exposure scope and document which environments permit unprivileged perf_event_open access; immediately check whether perf_event_open is already disabled in your security hardening baseline. Within 7 days, obtain and stage the vendor patch in a non-production environment, execute full functional testing against representative workloads, and coordinate patching windows with application and infrastructure teams to schedule maintenance. Within 30 days, deploy the patched kernel to all affected production systems in priority order (development environments first, then shared systems, then end-user systems), execute verification via vulnerability scanning or privilege escalation testing, and confirm reboots completed across your estate.

Linux Kernel CVE-2023-6931

HIGH

Out-of-bounds Write (CWE-787)

2023-12-19 cve-coordination@google.com

Privilege Escalation Buffer Overflow Linux Memory Corruption Debian Debian Linux

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only access via perf_event_open, PR:L for required user account, AC:H for heap grooming prerequisites; full kernel compromise justifies C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:32 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 14:22 NVD

7.8 (HIGH) 7.0 (HIGH)

CVE Published

Dec 19, 2023 - 14:15 cve.org

HIGH 7.8

DescriptionNVD

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

AnalysisAI

Local privilege escalation in the Linux kernel's Performance Events subsystem exposes any system permitting unprivileged perf_event_open calls to full kernel compromise. The root cause is an integer overflow in the read_size calculation within perf_read_group(), producing a heap out-of-bounds increment or write (CWE-787) that can corrupt kernel data structures. No active exploitation is confirmed via CISA KEV, and EPSS at 0.44% (63rd percentile) indicates moderate relative interest but low absolute exploitation probability, consistent with the high attack complexity required.

Technical ContextAI

The Linux kernel's Performance Events subsystem (perf_events), accessed via the perf_event_open syscall, enables hardware and software performance monitoring. The vulnerable path in perf_read_group() computes a read_size value that can overflow, causing subsequent heap memory writes to exceed allocated buffer boundaries - a classic CWE-787 Out-of-bounds Write. This class of flaw in kernel heap space can be exploited via heap grooming to overwrite adjacent kernel objects (e.g., cred structures, function pointers), enabling privilege escalation. Per CPE data, all Linux kernel versions are listed as affected (cpe:2.3:o:linux:linux_kernel:*), and Debian Linux 10.0 (Buster) is explicitly confirmed. Siemens has issued four separate CERT advisories (SSA-265688, SSA-398330, SSA-613116, SSA-794697) indicating downstream impact on industrial products shipping vulnerable kernel versions. The fix was coordinated and reported by Google's security team (cve-coordination@google.com).

RemediationAI

The primary fix is upgrading the Linux kernel past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b, available at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382c27f4ed28f803b1f1473ac2d8db0afc795a1b and mirrored at https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1b. The patch is available from vendor per the intelligence data, though no specific tagged kernel release version is independently confirmed in the provided references. Debian LTS users should apply the January 2024 updates from https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html. Siemens customers must consult the relevant product advisory at cert-portal.siemens.com for their specific platform. As an effective compensating control where patching is not immediately feasible, setting sysctl kernel.perf_event_paranoid=3 disables perf_event_open for unprivileged users entirely, eliminating the attack surface; the trade-off is loss of non-root performance monitoring capability. Alternatively, seccomp profiles that block the perf_event_open syscall in container workloads reduce exposure without system-wide impact.