CVE-2023-52672

A regression in the Linux kernel (introduced by commit c73be61cede5 ) can cause resized pipes to lock up under specific conditions. The issue occurs because the wakeup for pipe->wr_wait is triggered before pipe->max_usage is actually increased. If a pipe is full prior to the resize, the wak...

kernel: watch queue race condition can lead to privilege escalation

A race condition was found in the Linux kernel's watch queue due to a missing lock in the piperesizering. The race condition occurs when a thread uses ioctlIOCWATCHQUEUESETSIZE to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl to trigger a notification in th...