CVE-2023-39198
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.01%
- CWE
- CWE-366, CWE-416
- Published
- 2023-11-09
- Last modified
- 2026-03-24
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
Weakness type
Related vulnerabilities
- CVE-2026-3904 — Calling NSS-backed functions that support caching via nscd may call the...
- CVE-2026-23684 — Race condition vulnerability in SAP Commerce Cloud
- CVE-2026-22819 — Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts
- CVE-2025-31115 — XZ has a heap-use-after-free bug in threaded .xz decoder
- CVE-2024-10630 — A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local...
- CVE-2024-2032 — Race Condition Vulnerability in zenml-io/zenml
- CVE-2023-6546 — Kernel: gsm multiplexing race condition leads to privilege escalation
- CVE-2023-4732 — Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h