{"id":"CVE-2023-0266","kind":"vulnerability","aliases":["CVE-2023-0266"],"related":[],"title":"A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel","description":"A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e","summary":"The Linux kernel has a use-after-free bug in its sound subsystem (ALSA compress/PCM ioctl path) that a local user can trigger. An attacker who already has a low-privilege account on the machine can escalate to full kernel (ring 0) control.","severity":"high","cvss":7.9,"epss":null,"exploited":true,"exploited_at":"2023-03-30T00:00:00+00:00","products":[{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.14.303"],"affected":">= 4.14, < 4.14.303","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.19.270"],"affected":">= 4.15, < 4.19.270","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.4.229"],"affected":">= 4.20, < 5.4.229","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.163"],"affected":">= 5.5, < 5.10.163","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.88"],"affected":">= 5.11, < 5.15.88","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.6"],"affected":">= 5.16, < 6.1.6","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":null,"fix":"Apply the kernel update from your Linux distribution's vendor; CISA's KEV entry says 'Apply updates per vendor instructions'. Exact fixed kernel versions: unknown.","status":"open","published_at":"2023-01-30T14:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:27+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:08:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the kernel update from your Linux distribution's vendor; CISA's KEV entry says 'Apply updates per vendor instructions'. Exact fixed kernel versions: unknown.","reach":"local","impact":"high","summary":"The Linux kernel has a use-after-free bug in its sound subsystem (ALSA compress/PCM ioctl path) that a local user can trigger. An attacker who already has a low-privilege account on the machine can escalate to full kernel (ring 0) control.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root and full kernel control on the host","analyst_note":"Find the affected kernel version ranges and vendor fixed builds from the NVD or kernel.org CVE-2023-0266 record, and confirm the vulnerable subsystem before writing how_to_check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-kernel"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000474,"input_tokens":2776,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0266':18A,21A '-2023':17A,20A '0':88B '32':111C '56b88b50565cd8b946a2d00b0c83927b7ebb055e':145C 'access':135C 'account':78B 'alreadi':72B 'alsa':9A,59B,98C 'attack':70B 'bug':54B 'commit':144C 'compress/pcm':60B 'control':89B 'ctl':106C 'cve':16A,19A 'debian':22A 'elem':108C 'escal':83B,131C 'exist':6A,95C 'exploit':38B 'free':4A,53B,93C,124C 'full':85B 'gain':133C 'host':44B 'infrastructur':39B 'ioctl':61B,107C 'kernel':15A,25A,27A,29A,31A,33A,35A,37A,47B,86B,104C 'kubernet':40B 'linux':14A,23A,24A,26A,28A,30A,32A,34A,36A,41B,46B,103C 'local':65B 'lock':114C 'low':76B 'low-privileg':75B 'machin':81B 'miss':113C 'packag':11A,100C 'past':143C 'path':62B 'pcm':10A,99C 'priviledg':130C 'privileg':77B 'read':109C 'recommend':141C 'result':127C 'ring':87B 'ring0':134C 'self':43B 'self-host':42B 'sndrv':105C 'sound':57B 'subsystem':58B 'system':138C 'trigger':68B 'upgrad':142C 'use':2A,51B,91C,118C,122C 'use-after-fre':50B,121C 'user':66B,139C 'vulner':5A,94C 'write':110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-01-30T14:15:10+00:00","kev":{"dateAdded":"2023-03-30","dueDate":"2023-04-20","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-0266","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0266","severity":null,"published_at":"2023-03-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-0266","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0266","severity":null,"published_at":"2023-01-30T14:15:10+00:00","modified_at":"2026-06-17T05:25:09+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}