---
id: CVE-2023-33951
title: 'Kernel: vmwgfx: race condition leading to information disclosure vulnerability'
summary: >-
  A race condition vulnerability was found in the vmwgfx driver in the Linux
  kernel. The flaw exists within the handling of GEM objects. The issue results
  from improper locking when performing operations on an object. This flaw
  allows a lo…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-413
vendor: Red Hat
product: kernel-rt
affected:
  - kernel-rt (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel (all versions)
  - kernel-rt (all versions)
  - kernel
  - kernel
  - kernel-rt
  - kernel-rt (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-02-26T17:35:27.034494Z'
published: '2023-07-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T20:24:50.771Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-33951'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:6583'
    label: 'RHSA-2023:6583'
  - url: 'https://access.redhat.com/errata/RHSA-2023:6901'
    label: 'RHSA-2023:6901'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7077'
    label: 'RHSA-2023:7077'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1404'
    label: 'RHSA-2024:1404'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4823'
    label: 'RHSA-2024:4823'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4831'
    label: 'RHSA-2024:4831'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-33951'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2218195'
    label: RHBZ#2218195
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/'
tags:
  - cve.org
epss: 0.00343
epssPercentile: 0.28041
zeroDay: true
ingestedAt: '2026-11-06T21:04:04.251Z'
---

## Overview

A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

## Affected

- `kernel-rt (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel (all versions)`
- `kernel-rt (all versions)`
- `kernel`
- `kernel`
- `kernel-rt`
- `kernel-rt (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

This flaw can be mitigated by preventing the affected `vmwgfx` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.