CVE-2023-0266

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4	Mailing List Patch Vendor Advisory
https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e	Patch
https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1	Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	Mailing List Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4	Mailing List Patch Vendor Advisory
https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e	Patch
https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1	Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

16 Sep 2025, 14:15

Type	Values Removed	Values Added
First Time		Debian debian Linux Debian
CPE		cpe:2.3:o:debian:debian_linux:10.0:::::::*
References	~~() https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - Patch, Third Party Advisory~~	() https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - Patch
References	~~() https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - Patch, Third Party Advisory~~	() https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - Patch

13 Feb 2025, 17:15

Type	Values Removed	Values Added
Summary	(en) A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ\|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e	(en) A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ\|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

21 Nov 2024, 07:36

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 7.9
Summary		(es) Existe una vulnerabilidad de Use-After-Free en el paquete ALSA PCM en el kernel de Linux. A SNDRV_CTL_IOCTL_ELEM_{READ\|WRITE}32 le faltan bloqueos que se pueden usar en un Use-After-Free que puede resultar en una escalada de privilegios para obtener acceso al anillo 0 por parte del usuario del sistema. Recomendamos actualizar al commit anterior 56b88b50565cd8b946a2d00b0c83927b7ebb055e
References	() https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 - Mailing List, Patch, Vendor Advisory	() https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 - Mailing List, Patch, Vendor Advisory
References	~~() https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - Patch, Third Party Advisory~~	() https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - Patch, Third Party Advisory
References	~~() https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - Patch, Third Party Advisory~~	() https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - Patch, Third Party Advisory
References	~~() https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - Mailing List, Third Party Advisory~~	() https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - Mailing List, Third Party Advisory

03 May 2023, 14:15

Type	Values Removed	Values Added
Summary	A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ\|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e	A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ\|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CPE		cpe:2.3:o:linux:linux_kernel:6.2:rc2:::::: cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.2:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.2:rc1::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CWE		CWE-416
References		(MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html -
References	~~(MISC) https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e -~~	(MISC) https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - Patch, Third Party Advisory
References	~~(MISC) https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 -~~	(MISC) https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - Patch, Third Party Advisory
References	(MISC) https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 -	(MISC) https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 - Mailing List, Patch, Vendor Advisory

30 Jan 2023, 14:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-01-30 14:15

Updated : 2025-09-16 14:15

NVD link : CVE-2023-0266

Mitre link : CVE-2023-0266

CVE.ORG link : CVE-2023-0266

JSON object : View

Products Affected

debian

debian_linux

linux

linux_kernel

CWE

CWE-416

Use After Free

7.9 /10