The Linux Possible GSM Privilege Escalation analytic detects commands and process flows associated with a race condition in the GSM 0710 tty multiplexor of the Linux kernel. Specifically, when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, a local unprivileged user could escalate privileges. The detection uses endpoint telemetry (EDR) with the Endpoint.Processes data model and CIM-normalized fields to look for suspicious activity, including rmmod, n_gsm, and shell invocations (bash, dash, sh, zsh), along with complete command lines and parent/child process relationships. The search aggregates by process information and related metadata to surface potential activity, and supports drilldowns to review results for particular users or destinations and to correlate with risk events. The rule aligns with MITRE ATT&CK T1068 (Privilege Escalation) and references CVE-2023-6546. It targets Linux-based Endpoint assets and assumes ingestion of detailed process telemetry from EDR agents. A known false-positive vector includes legitimate administrative or testing activity that modifies GSM configurations. References include Red Hat CVE and a ZDI advisory, and a test dataset is included for validation of the detection.