CVE-2014-0196: Linux kernel n_tty_write race condition allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is listed in CISA KEV with public exploit code and a high EPSS percentile, and it allows local privilege escalation or denial of service.

What it is

The n_tty_write function in the Linux kernel through 3.14.3 mishandles tty driver access in the LECHO & !OPOST case, creating a race condition between read and write operations with long strings. This can corrupt memory, crash the system, or let a local user gain privileges. It matters because the flaw is reachable by any local user with tty access and has public exploit code.

Impact

A local attacker can cause a denial of service via system crash or memory corruption, and potentially escalate privileges on the affected host.

Attack surface

Reached locally through tty read/write operations; the CVSS vector shows AV:L, PR:L, UI:N, so a local user with low privileges and no user interaction is required.

Exploitation

CISA KEV lists it as exploited, EPSS is 0.22475 (97.6th percentile), and references include Exploit and ExploitDB tags, indicating public exploit code exists.

What to do

• Patch the Linux kernel to a version that includes the fix for CVE-2014-0196, or apply the vendor errata for your distribution.
• If the affected product is end-of-life, disconnect it from the network as directed by CISA KEV.
• Restrict local shell and tty access to trusted users only.
• Monitor vendor advisories for updated kernels and reapply patches as needed.

Detection

• Monitor system logs for kernel oops, panic, or memory corruption messages tied to tty or n_tty operations.
• Watch for unexpected privilege changes or suspicious local process behavior on hosts with unpatched kernels.
• Use host-based monitoring to detect unusual tty read/write patterns or repeated crashes from local users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.