CVE-2023-42756

What it actually does

Race condition in Netfilter ipset between IPSET_CMD_ADD and IPSET_CMD_SWAP invokes __ip_set_put on an incorrect set, triggering kernel panic.

Why it matters to the business

Local denial-of-service crashes can interrupt services, require reboots, and reduce system availability on Linux hosts; high ecosystem prevalence increases exposure across servers and appliances.

How an attack unfolds

A local attacker with low privileges issues concurrent ipset add and swap commands to trigger the race, causing the kernel to dereference an invalid set and panic; public exploits exist and generic Linux kernel threat actor activity has been observed.

How to fix it

Upgrade the Linux kernel to the commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; apply vendor backports for supported distributions and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or equivalent fixed version; attempt reproduction of the race under controlled conditions to confirm absence of panic.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Prepare concurrent calls to IPSET_CMD_ADD and IPSET_CMD_SWAP
3. Trigger the race condition to invoke __ip_set_put on the wrong set
4. Induce kernel panic and system crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing ip_set_put or netfilter ipset around the time of unexpected reboots; correlate with process activity invoking ipset commands.

What your security team should do

• Prioritize patching within standard maintenance windows given low EPSS and local-only vector
• Restrict unprivileged local access where feasible until patches are deployed
• Monitor kernel logs for ipset-related panics as an interim detection measure