Kernel: gsm multiplexing race condition leads to privilege escalation

Summary

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.

Timeline

1. Dec 21, 2023, 8:01 PM UTCCVE published
2. Aug 6, 2026, 7:08 PM UTCRecord last updated

Affected versions

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• openshift-logging/cluster-logging-operator-bundle

  Version range not reported

• openshift-logging/cluster-logging-rhel8-operator

  Version range not reported

• openshift-logging/elasticsearch6-rhel8

  Version range not reported

• openshift-logging/elasticsearch-operator-bundle

  Version range not reported

• openshift-logging/elasticsearch-proxy-rhel8

  Version range not reported

• openshift-logging/elasticsearch-rhel8-operator

  Version range not reported

• openshift-logging/eventrouter-rhel8

  Version range not reported

• openshift-logging/fluentd-rhel8

  Version range not reported

• openshift-logging/kibana6-rhel8

  Version range not reported

• openshift-logging/log-file-metric-exporter-rhel8

  Version range not reported

• openshift-logging/logging-curator5-rhel8

  Version range not reported

• openshift-logging/logging-loki-rhel8

  Version range not reported

• openshift-logging/logging-view-plugin-rhel8

  Version range not reported

• openshift-logging/loki-operator-bundle

  Version range not reported

• openshift-logging/loki-rhel8-operator

  Version range not reported

• openshift-logging/lokistack-gateway-rhel8

  Version range not reported

• openshift-logging/opa-openshift-rhel8

  Version range not reported

• openshift-logging/vector-rhel8

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel-rt

  Version range not reported

References 24