Description
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.
Affected products
linux: linux kernel; fedoraproject: fedora; redhat: enterprise linux
References10
- bugzilla.redhat.com/show_bug.cgi?id=2255498 Issue TrackingPatchThird Party Advisory
- github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465… Patch
- bugzilla.redhat.com/show_bug.cgi?id=2255498 Issue TrackingPatchThird Party Advisory
- github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465… Patch
- access.redhat.com/errata/RHSA-2024:0930
- access.redhat.com/errata/RHSA-2024:0937
- access.redhat.com/errata/RHSA-2024:1018
- access.redhat.com/errata/RHSA-2024:1019
- access.redhat.com/errata/RHSA-2024:1055
- access.redhat.com/errata/RHSA-2024:1250
Metrics
- CVSS 3.1
-
7.0
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 55 · as of 5 November 2026
- CWE
- CWE-366CWE-362
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.