Local privilege escalation via interrupted module autoload
Published May 21, 2024 · Updated Aug 5, 2026
Use-after-free in Linux kernel 6.1 through 6.1.12 allows local users to corrupt kernel memory by interrupting module autoload. The KILLABLE path in call_usermode_helper_exec() returns after SIGKILL without the unconditional wait_for_completion(), allowing umh_complete() to access an expired on-stack completion. An unprivileged local user can trigger request_module(), signal the waiting process, and race the late completion to escalate privileges or crash or hang the system.
Summary
What happened
Use-after-free in Linux kernel 6.1 through 6.1.12 allows local users to corrupt kernel memory by interrupting module autoload. The KILLABLE path in call_usermode_helper_exec() returns after SIGKILL without the unconditional wait_for_completion(), allowing umh_complete() to access an expired on-stack completion. An unprivileged local user can trigger request_module(), signal the waiting process, and race the late completion to escalate privileges or crash or hang the system.
The record
- CVE
- CVE-2023-52704
- Published
- May 21, 2024
- Updated
- Aug 5, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux
- Classifications
- T1068
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- May 21, 2024CVE publishedPublication date reported by the CVE source.
- Aug 5, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=6.1
- Affected versionversion=f5d39b020809146cc28e6e73369bf8065e0310aa <7f9f6c54da876b3f0bece2b569456ceb96965ed7
- Affected versionversion=f5d39b020809146cc28e6e73369bf8065e0310aa <eedeb787ebb53de5c5dcf7b7b39d01bf1b0f037d
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo