CVE-2014-0196 Linux Kernel Race Condition

Exploited in the wild Medium 5.5 Published 7 May 2014 Updated 22 Oct 2025

Local attackers can exploit a race condition in the Linux kernel TTY driver to cause memory corruption, leading to system crashes or privilege escalation.

Exploited in the wild: Since 12 May 2023
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0196?

CVE-2014-0196 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 7 May 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

Weakness: CWE-362

Which versions are affected by CVE-2014-0196?

It affects 30 products.

Linux distribution packages (40)

`kernel` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-abi-whitelists` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug-devel` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debuginfo-common-x86_64` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-devel` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-doc` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-headers` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-libs` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-libs-devel` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`perf` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`perf-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`python-perf` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`python-perf-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.10.0-123.1.2.el7`
`kernel` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-abi-whitelists` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debuginfo-common-x86_64` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-doc` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-headers` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel-tools-libs-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`perf` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`perf-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`python-perf` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`python-perf-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.10.0-123.1.2.el7`
`kernel` Red Hat:enterprise_linux:7::server	All versions	`0:3.10.0-123.1.2.el7`
`kernel-abi-whitelists` Red Hat:enterprise_linux:7::server	All versions	`0:3.10.0-123.1.2.el7`
`kernel-bootwrapper` Red Hat:enterprise_linux:7::server	All versions	`0:3.10.0-123.1.2.el7`
`kernel-debug` Red Hat:enterprise_linux:7::server	All versions	`0:3.10.0-123.1.2.el7`

Products include Canonical Ubuntu Linux, Debian Debian Linux, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager and 24 more.

How do I fix CVE-2014-0196?

Apply the vendor's patch. US federal agencies must fix it by 2 Jun 2023.

Is CVE-2014-0196 being exploited?

Yes. Attackers have exploited CVE-2014-0196 in the wild since at least 12 May 2023.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as CVE-2014-9791, DEBIAN-CVE-2014-0196, GHSA-xwpg-vm43-3qwm, RHSA-2014:0512, RHSA-2014:0678, UBUNTU-CVE-2014-0196 and 1 more.