CVE-2023-6546High· 7.0▾ Abyssal0dayPoC availableA race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a u…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 38.5 · likelihood 0.1 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
1 GitHub repo
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.
linux_kernel < 6.5linux_kernel = 6.5fedora = 39enterprise_linux = 8.0enterprise_linux = 9.0Upgrade past the affected range:
linux_kernel 6.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-3564Medium· 5.5A vulnerability classified as critical was found in Linux Kernel
CVE-2022-3303Medium· 4.7A race condition flaw was found in the Linux kernel sound subsystem due to improper locking
CVE-2022-29582High· 7.0In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts
CVE-2021-44733High· 7.0A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11
CVE-2022-3521Low· 2.6A vulnerability has been found in Linux Kernel and classified as problematic
CVE-2022-2959High· 7.0A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring()