CVE-2023-51782

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-11 · updated 2026-06-17
Weakness: CWE-416

Description

An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.

Affected products

Debian Linux: 10.0
Linux kernel: from 2.6.12 (excl.) before 6.6.8; 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5, 2.6.12-rc6, 6.7-rc1 (+4) — fixed in 6.6.8

How to fix

Upgrade to a fixed version: Linux kernel 6.6.8. Check the vendor advisory for mitigations.

References

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8
https://github.com/torvalds/linux/commit/810c38a369a0a0ce625b5c12169abce1dd9ccd53
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8
https://github.com/torvalds/linux/commit/810c38a369a0a0ce625b5c12169abce1dd9ccd53
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html

Get alerted when CVE-2023-51782 or the next vulnerability affects your stack