CVE-2023-3567: Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-24 · updated 2026-06-17
Weakness: CWE-416

Description

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04, 22.04
Linux kernel: before 6.2.0; 6.2.0-rc1, 6.2.0-rc2, 6.2.0-rc3, 6.2.0-rc4, 6.2.0-rc5, 6.2.0-rc6 — fixed in 6.2.0
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 6.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3567 or the next vulnerability affects your stack