Kernel: gsm multiplexing race condition leads to privilege escalation

Description

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.

Scores

EPSS (exploitation in 30 days)

0.73% · top 45% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

• CWE-366: Race Condition within a Thread (opens in a new tab)All about CWE-366 and its CVEs
• CWE-362 (opens in a new tab)All about CWE-362 and its CVEs

Affected products

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-513.24.1.rt7.326.el8_9 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-513.24.1.el8_9 – < *

• Red Hat · Red Hat Enterprise Linux 8

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support

  • unaffected 0:4.18.0-193.136.1.el8_2 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:4.18.0-305.134.1.el8_4 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Service

  • unaffected 0:4.18.0-305.134.1.rt7.210.el8_4 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Service

  • unaffected 0:4.18.0-305.134.1.el8_4 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

  • unaffected 0:4.18.0-305.134.1.el8_4 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support

  • unaffected 0:4.18.0-372.93.1.el8_6 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support

  • unaffected 0:4.18.0-477.55.1.el8_8 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.14.0-427.13.1.el9_4 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.14.0-427.13.1.el9_4 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Support

  • unaffected 0:5.14.0-70.93.2.el9_0 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Support

  • unaffected 0:5.14.0-70.93.1.rt21.165.el9_0 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Support

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support

  • unaffected 0:5.14.0-284.55.1.el9_2 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support

  • unaffected 0:5.14.0-284.55.1.rt14.340.el9_2 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support

  All versions: unaffected

• Red Hat · Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

  • unaffected 0:4.18.0-372.93.1.el8_6 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-16 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-7 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v6.8.1-408 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-19 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v1.0.0-480 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-9 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v0.4.0-248 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v1.14.6-215 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v6.8.1-431 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v1.1.0-228 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.8.1-471 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v2.9.6-15 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-3 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-27 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v5.7.13-12 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v0.1.0-527 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v0.1.0-225 – < *

• Red Hat · RHOL-5.7-RHEL-8

  • unaffected v0.28.1-57 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 9

  All versions: affected

What to do

Workaround: This flaw can be mitigated by preventing the affected `n_gsm` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.

References (31)

• RHSA-2024:0930 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:0937 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1018 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1019 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1055 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1250 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1253 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1306 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1607 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1612 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1614 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2093 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2394 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2621 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2697 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:4577 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:4729 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:4731 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:4970 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2023-6546 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
• RHBZ#2255498 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
• https://github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465531cde53e3 (opens in a new tab)x_transferred
• https://www.zerodayinitiative.com/advisories/ZDI-CAN-20527 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/10/18 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/10/21 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/11/7 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/11/9 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/12/1 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/12/2 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/16/2 (opens in a new tab)x_transferred
• http://www.openwall.com/lists/oss-security/2024/04/17/1 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-6546](https://trackcve.app/badge/CVE-2023-6546.svg)](https://trackcve.app/cve/CVE-2023-6546)

Record last updated 4 Nov 2026, 21:07 UTC.