CVE-2023-22998
Linux Kernel ≤ 6.0.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-22998 is a medium-severity Interpretation Conflict (CWE-436) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27098
Vulnerability Data
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates a secure SDLC process with checkpoints, secure coding, testing and training; it does not stop differing interpretations of shared state or inputs between two products from arising or being exploited
A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any mechanism that stops an interpretation conflict from being exploitable.
A.8.27 establishes and applies secure-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, hardening, etc.) but does not stop two products from interpreting the same input or protocol step differently; the resulting state/conflict weakness can still be present and exploitable.
Secure coding standards can enforce canonical input handling and strict protocol compliance to avoid misinterpretation between products.
Security testing can detect and correct cases where one component misinterprets another’s state or messages.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-436, a class-level weakness, and none of its children carries one either.