CVE-2023-51780 is a use after free in the Linux kernel's ATM code, in do_vcc_ioctl in net/atm/ioctl.c, caused by a race condition. Kernels before 6.6.8 are affected. The record rates it High at 7.0. Update to 6.6.8 or later, or to a distribution kernel that carries the fix.
What's affected
The record says the Linux kernel before 6.6.8 is affected. The 6.6.8 stable release is the point at which the fix appears in the upstream ChangeLog. The record also lists Debian Linux 10.0 among affected products, and Debian published LTS announcements about kernel updates in January 2024.
Most people do not run a vanilla kernel. Distributions backport fixes without changing the headline version number, so a kernel that reports an older version may still contain the patch. The record and the advisories we read do not list fixed versions for each distribution. Check your vendor's security tracker for this CVE.
The record gives a CVSS score of 7.0 (High). The CVSS vector reads as follows. The attack needs local access to the system, and the complexity is high. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-416.
How to check if you're exposed
Start with the running kernel version. On Linux, run uname -r. If it reports a version at or above 6.6.8 from the 6.6 series or a later series, the upstream fix is present.
If it reports an older version, do not conclude that you are exposed. Check your distribution's changelog for the CVE number. The commands below show the package changelog on the two common families.
apt changelog linux-image-$(uname -r) | grep CVE-2023-51780
rpm -q kernel --changelog | grep CVE-2023-51780
Then ask whether the code is even reachable. The vulnerable code is the ATM protocol support. Run lsmod | grep atm to see whether the module is loaded. On most servers it is not.
What to do now
- Identify the running kernel on every Linux host, with
uname -r. - Check your distribution's security tracker for this CVE and install the kernel update it recommends.
- Reboot into the new kernel, since a kernel update does not take effect until then.
- If the protocol is unused, consider keeping the module from loading. Do that through your normal change process.
- Record the hosts where the module is loaded, because those are the ones to patch first.
Why it matters
The weakness is a use after free, CWE-416. The kernel frees a piece of memory while another code path still holds a pointer to it. Here, a race between the vcc_recvmsg path and the ioctl handler lets that happen. If an attacker wins the race, the freed memory can be reused in a way that corrupts kernel state.
The vector calls for local access and a low privilege account, and it rates attack complexity as high because winning a race is unreliable. That keeps the score at 7.0. It does not make it safe, since kernel memory corruption bugs are a common step toward privilege escalation on shared machines.
The practical lens is reachability. A flaw in an old network protocol that your hosts never load is much less urgent than one in a core component. Good tooling helps you tell the difference instead of treating all kernel CVEs as equal.
Try it yourself
See how reachability analysis separates code that is loaded and callable from code that only exists on disk.
Click through it at your own pace, or open it full screen.
Quick check
Is my kernel affected if it is older than 6.6.8?
Not necessarily. Distributions backport fixes. Check your vendor's tracker or package changelog for the CVE id.
Do I need a reboot?
Yes. A kernel update only takes effect once you boot into it, unless you use a live patching service from your vendor.
Sources
Last reviewed: 19 October 2026.
