CVE-2023-0266

CVE-2023-0266 is a use-after-free vulnerability in the ALSA PCM package of the Linux Kernel, specifically affecting Debian and other Linux distributions. This flaw allows a local attacker to achieve privilege escalation to ring0 access due to missing locks in SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32. With a CVSS score of 7.0 (HIGH), exploitation requires low privileges but high attack complexity, leading to high impacts on confidentiality, integrity, and availability. This vulnerability is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog and extensive media coverage, despite no public exploit code being available on platforms like Metasploit or ExploitDB. The vulnerability has garnered significant community discussion, indicating high awareness and concern.