CVE-2023-23039

Published: Feb 22, 2023Modified: Jun 17, 2026

5.7

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 0.5 / Impact: 5.2

Source: NVD

Description

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Affected (3)

Products: Linux: Linux Kernel

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 6.2.0
Linux Linux Kernel	Version 6.2.0 rc1
Linux Linux Kernel	Version 6.2.0 rc2

Related CWEs

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (2)

https://lkml.org/lkml/2023/1/1/169

Source: cve@mitre.org

Mailing ListPatch

https://lkml.org/lkml/2023/1/1/169

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

Timeline

No history available yet.