Read the docs
TI-2023-28408 Aliases CVE-2023-51780GHSA-h76p-mprh-fvmv

An issue was discovered in the Linux kernel before 6.6.8.

Priority LOW 31CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

Why it matters now

EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 9 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*after 2.6.12, before 6.6.8VulnerableLinux
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*2.6.12 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*2.6.12 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*2.6.12 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*2.6.12 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:*2.6.12 rc6VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*6.7 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*6.7 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*6.7 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*6.7 rc4VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions after 2.6.12, before 6.6.8 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* Versions 2.6.12 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* Versions 2.6.12 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* Versions 2.6.12 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* Versions 2.6.12 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:* Versions 2.6.12 rc6 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:* Versions 6.7 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:* Versions 6.7 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:* Versions 6.7 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:* Versions 6.7 rc4 Vulnerable ·Linux
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*6.7 rc5VulnerableLinux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:* Versions 6.7 rc5 Vulnerable ·Linux
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Red Hat 3 advisories

  • RHSA-2024:2950 Released 2024-05-22 · Red Hat rating Moderate
    kernel-rt security and bug fix update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.rt7.342.el8_10, kernel-rt-core-4.18.0-553.rt7.342.el8_10, kernel-rt-debug-4.18.0-553.rt7.342.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.rt7.342.el8_10, kernel-rt-core-4.18.0-553.rt7.342.el8_10, kernel-rt-debug-4.18.0-553.rt7.342.el8_10 +7
  • RHSA-2024:3138 Released 2024-05-22 · Red Hat rating Moderate
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.el8_10, kernel-4.18.0-553.el8_10, kernel-abi-stablelists-4.18.0-553.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.el8_10
  • RHSA-2024:2394 Released 2024-04-30 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.13.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.13.1.el9_4, kernel-64k-devel-5.14.0-427.13.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.13.1.el9_4, kernel-5.14.0-427.13.1.el9_4, kernel-64k-5.14.0-427.13.1.el9_4 +29
    • Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.13.1.el9_4, libperf-5.14.0-427.13.1.el9_4
    • Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +11
    • Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.13.1.el9_4, kernel-rt-core-5.14.0-427.13.1.el9_4, kernel-rt-debug-5.14.0-427.13.1.el9_4 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2394
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:3138
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:2394
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:3138
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:2394
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2024:2950
Red Hat Enterprise Linux NFV (v. 9)Fixed RHSA-2024:2394
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2024:2950
Red Hat Enterprise Linux RT (v. 9)Fixed RHSA-2024:2394

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-51780
  2. 2026-10-03 Alias added: GHSA-h76p-mprh-fvmv

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences