CVE-2023-52872

tty: n_gsm: fix race condition in status line change on dead connections

HIGH
7.8
CVSS Score
Published: May 21, 2024 at 03:32 PM UTC
Updated: August 5, 2026 at 10:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix race condition in status line change on dead connections gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs. Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive. Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.18.18v ≥ 5.19.25.15.61 ≤ v < 5.15.1385.18.18 ≤ v < 5.195.19.2 ≤ v < 5.205.19.2 ≤ v < 6.1.626.0 ≤ v < 6.1.626.0 ≤ v < 6.5.116.0 ≤ v < 6.6.16.0 ≤ v < 6.76.2 ≤ v < 6.5.116.6 ≤ v < 6.6.15.15.615.18.185.19.26.0692e847a8e6607909c4a3f98ab16ccee7849bd11c568f7086c6e771c77aad13d727c70ef70e07243d834aba5f30d9a6f98f4ca1eb07e501f1989331cdd37f657387853623f20c1b2482afbb9cd8ece33
Vendor states this is fixed in 19d34b73234af542cc8a218cf398dee73cdb1890 (fixed)
Vendor states this is fixed in 3a75b205de43365f80a33b98ec9289785da56243 (fixed)
Vendor states this is fixed in 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444 (fixed)
Vendor states this is fixed in ce4df90333c4fe65acb8b5089fdfe9b955ce976a (fixed)
Vendor states this is fixed in df6cfab66ff2a44bd23ad5dd5309cb3421bb6593 (fixed)
Vendor states this is fixed in 5.15.138 (unaffected)
Affected range stops below 5.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.1.62 (unaffected)
Vendor states this is fixed in 6.5.11 (unaffected)
Vendor states this is fixed in 6.6.1 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-362

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card