Every CVESearch/Get API key

CVE-2023-23039

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race...

5.7 MediumFix available

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.21%Down 0.7 points since Feb 23, 2023
90%50%10%1%

What each source reports

NVD Score used5.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
CVE List5.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2023-271395.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
EUVD-2023-27139
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hr7h-xh5g-347q5.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race...

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
GHSA-hr7h-xh5g-347q
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
OSVAZL-138205.7

CVE-2023-23039 affecting package kernel for versions less than 5.15.135.1-2

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
AZL-13820
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2023-230395.7

CVE-2023-23039 does not affect BellSoft software

Record
BELL-CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV5.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-230395.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
DEBIAN-CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2023-230395.7

CVE-2023-23039 in linux - Patched by Root

Root has patched CVE-2023-23039 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-230395.7

CVE-2023-23039 in linux - Patched by Root

Root has patched CVE-2023-23039 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-230395.7

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

Record
UBUNTU-CVE-2023-23039
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kernel
Azure Linux:2
before 5.15.135.1-2
5.15.135.1-2
linux
Debian:12
All versions, plus listed versions
6.1.106-16.1.106-26.1.106-36.1.112-16.1.115-1
Show 45 moreShow less
6.1.119-16.1.123-16.1.124-16.1.128-16.1.129-16.1.133-16.1.135-16.1.137-16.1.139-16.1.140-16.1.147-16.1.148-16.1.153-16.1.158-16.1.159-16.1.162-16.1.164-16.1.170-16.1.170-26.1.170-36.1.172-16.1.174-16.1.176-16.1.177-16.1.180-16.1.187-16.1.190-16.1.27-16.1.37-16.1.38-16.1.38-26.1.38-2~bpo11+16.1.38-36.1.38-46.1.38-4~bpo11+16.1.52-16.1.55-16.1.55-1~bpo11+16.1.64-16.1.66-16.1.67-16.1.69-16.1.69-1~bpo11+16.1.76-16.1.76-1~bpo11+1
None known
linux
Debian:13
All versions, plus listed versions
6.12.100-16.12.101-16.12.105-16.12.107-16.12.111-1
Show 45 moreShow less
6.12.113-16.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp1
None known
linux
Debian:14
All versions, plus listed versions
6.12.100-16.12.101-16.12.105-16.12.107-16.12.111-1
Show 45 moreShow less
6.12.113-16.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp1
None known
linux
Root:Debian:11
before 5.10.262-1.aikido.113
5.10.262-1.aikido.1135.10.262-1.aikido.114
rootio-linux
Root:Debian:11
before 5.10.262-1.aikido.113
5.10.262-1.aikido.1135.10.262-1.aikido.114
linux
Root:Debian:12
before 6.1.190-1.aikido.167
6.1.190-1.aikido.167
rootio-linux
Root:Debian:12
before 6.1.190-1.aikido.167
6.1.190-1.aikido.167

History

History
RecordedChangedSources
affected, aliases, facts
affected
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23039 is a medium vulnerability (CVSS 5.7) in Linux Kernel, published February 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in kernel 5.15.135.1-2.

References

This page doesn't list everything

Left out here: 601 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open