CVE-2023-0266

HIGH KEV

Linux Kernel >=4.14 <4.14.303 - Use-After-Free in ALSA PCM via Missing Locks

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-0266 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 30, 2023. EIP tracks 1 public exploit from researchers including SeanHeelan.

AI-analyzed exploit summary This repository is a writeup demonstrating that Claude 3 Opus fails to identify CVE-2023-0266, a race condition vulnerability in the Linux kernel's ALSA control subsystem due to missing lock acquisition in the compat ioctl path.

Description

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

Exploits (1)

nomisec WRITEUP 17 stars
by SeanHeelan · poc
https://github.com/SeanHeelan/claude_opus_cve_2023_0266

This repository is a writeup demonstrating that Claude 3 Opus fails to identify CVE-2023-0266, a race condition vulnerability in the Linux kernel's ALSA control subsystem due to missing lock acquisition in the compat ioctl path.

Classification
Writeup 100%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Linux kernel ALSA control subsystem (versions affected by CVE-2023-0266)
No auth needed
Prerequisites: Access to a vulnerable Linux kernel with ALSA control subsystem
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 7.9
EPSS 0.0370
EPSS Percentile 88.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2023-03-30
VulnCheck KEV 2023-03-29
InTheWild.io 2023-01-12
ENISA EUVD EUVD-2023-12345
CWE
CWE-416
Status published
Products (2)
debian/debian_linux 10.0
linux/linux_kernel 4.14 - 4.14.303
Published Jan 30, 2023
KEV Added Mar 30, 2023
Tracked Since Feb 18, 2026