CVE-2023-0266: Linux Kernel ALSA PCM use-after-free allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityActive exploitation is confirmed by CISA KEV and the flaw yields kernel-level privilege escalation, though it requires local access and a race condition.

What it is

The ALSA PCM subsystem in the Linux kernel is missing locks around SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32, creating a use-after-free condition. A local user can trigger the race to corrupt kernel memory and escalate privileges. The flaw is confirmed as exploited in the wild per CISA KEV.

Impact

An attacker with a local account gains ring0 (kernel) access, effectively full control of the host and the ability to bypass all user-space protections.

Attack surface

Reached locally through ALSA control ioctls on a system with the vulnerable kernel; the CVSS vector (AV:L/PR:L/UI:N) indicates a local attacker with low privileges and no user interaction.

Exploitation

CVE-2023-0266 is listed in CISA KEV with a 2023-04-20 remediation due date, confirming active exploitation; EPSS 30-day probability is 0.037 (89th percentile).

What to do

• Apply the upstream kernel patches (commits 56b88b50565cd8b946a2d00b0c83927b7ebb055e and becf9e5d553c2389d857a3c178ce80fdb34a02e1) or the vendor kernel update.
• Update Debian and other distribution kernels per vendor advisories; reboot to load the fixed kernel.
• Restrict local shell and container access to trusted users, since exploitation requires a local account.
• Where patching is delayed, consider blocking or restricting access to ALSA control device nodes for untrusted users.
• Track KEV remediation deadlines and verify kernel versions across all hosts, including containers sharing the host kernel.

Detection

• Monitor for unexpected kernel crashes or oops messages referencing ALSA PCM or snd_ctl_elem_read/write.
• Alert on privilege changes from non-root to root or ring0 activity outside normal administrative workflows.
• Audit local user accounts and processes invoking ALSA control ioctls, especially from containers or unprivileged services.
• Check kernel versions against the patched commits and flag hosts still running vulnerable builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.