FreeBSD -- Kernel use-after-free via tty ioctls

Problem Description: The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling proces...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001363 advisory. A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/ttyjobctrl.c allows a use-after-free attack against TIOCSPGRP, ak...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002326 advisory. Race condition in the ttyioctl function in drivers/tty/ttyio.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memor...

DEBIAN-CVE-2023-6546

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOCSETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsmdlci while restarting th...

PT-2023-8000

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC SETCONF ioctl on the same tty file descriptor with t...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in Linux kernel version 6.2, which originates from a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hciuartttyioctl in...

PT-2023-2679

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.2 Description The issue is related to a race condition in the hci uart tty ioctl function between HCIUARTSETPROTO and HCIUARTGETPROTO commands in the drivers/bluetooth/hci ldisc.c module. This can lead to a NULL pointer...

SUSE CVE-2016-0723

Race condition in the ttyioctl function in drivers/tty/ttyio.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service use-after-free and system crash by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl...

USN-2930-2 linux-lts-wily vulnerabilities

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPTSOSETREPLACE events. A local unprivileged attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges...

PT-2016-4389

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.4.1 Description A race condition in the tty ioctl function in drivers/tty/tty io.c may allow local users to obtain sensitive information from kernel memory or cause a denial of service, such as a use-after-free...

Linux Kernel (PonyOS 3.0) - TTY ioctl() Local Privilege Escalation

Linux Kernel PonyOS 3.0 - TTY ioctl Local Privilege Escalation / Exploit Title: PonyOS include include int main struct winsize ws; printf"+ PonyOS = 3.0 ioctl local root exploit\n"; memcpy&ws,"\x90\x90\x90\x90\x8b\x45\x08\x89",8; ioctl0, TIOCSWINSZ, &ws; ioctl0, TIOCGWINSZ, void 0x0010f101;...