CVE-2023-51780

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-11 · updated 2026-06-17
Weakness: CWE-416

Description

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

Affected products

Debian Linux: 10.0
Linux kernel: from 2.6.12 (excl.) before 6.6.8; 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 2.6.12-rc6, 6.7-rc1 (+4) — fixed in 6.6.8

How to fix

Upgrade to a fixed version: Linux kernel 6.6.8. Check the vendor advisory for mitigations.

References

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8
https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
https://security.netapp.com/advisory/ntap-20240419-0001/
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8
https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
https://security.netapp.com/advisory/ntap-20240419-0001/

Get alerted when CVE-2023-51780 or the next vulnerability affects your stack