Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV A H L N C L H H 7.9 .0370 89.4 YES
AFFECTED Product Versions Fixed Linux Kernel 4.14 – —
TIMELINE Jan 13 Reserved by Google Jan 30 Published (CNA: Google) Mar 30 Added to CISA KEV, remediation due 2023-04-20
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
| Date | Event | Detail |
|---|---|---|
| January 13, 2023 | Reserved | Reserved by Google |
| January 30, 2023 | Published | Published (CNA: Google) |
| March 30, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-04-20 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Linux | Linux Kernel | — | 4.14 | — |
Authoritative record: CVE-2023-0266 at cve.org
Vendors: linux
Weaknesses: CWE-416
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-0266 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
