CVE-2023-52872

What it actually does

Race condition between gsm_cleanup_mux() and gsm_modem_update() allows status line changes on dead DLCIs to re-queue data and restart deleted timers after resources have been freed, resulting in kernel panic.

Why it matters to the business

Unexpected system crashes on devices using the n_gsm serial multiplexer, leading to downtime and loss of connectivity for affected Linux-based systems and embedded products.

How an attack unfolds

An attacker with local access triggers repeated virtual modem status changes on a GSM DLCI while gsm_cleanup_mux() is concurrently tearing down the mux; the update path bypasses the now-deleted timer and queue checks, causing the kernel to dereference freed structures and panic.

How to fix it

Upgrade the Linux kernel to a fixed release containing commit 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444 (for example 5.15.138 or later stable trees) and rebuild any custom kernels or Android builds with the patch applied.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking /proc/version or the git commit in the kernel source tree; attempt to reproduce the original race under load to verify absence of panic.

Typical attack path

1. Obtain local code execution on the target system
2. Open or manipulate a /dev/ttyGSMx virtual device backed by n_gsm
3. Trigger concurrent cleanup of the mux (e.g., via module unload or connection termination) while issuing modem status updates
4. Cause the kernel to panic due to use of freed timers and queues

How to detect it

Review kernel logs for oops or panic messages referencing gsm_cleanup_mux, gsm_modem_update, or n_gsm timers; correlate with processes that open GSM virtual ttys immediately prior to the crash.

What your security team should do

• Prioritize kernel updates on all systems exposing n_gsm devices (embedded, automotive, Android kernels)
• Apply the patch or upgrade to the listed fixed versions within normal patch windows given low EPSS and absence from KEV
• Monitor upstream stable kernel releases for backports of 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444