PT-2023-9694 · Linux+5 · Linux Kernel+5

Koichiro Den · Published 2023-10-28 · Updated 2025-09-29 · CVE-2023-52801

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the use of memory after it has been freed in the iopt area split() function of the iommufd component, due to incorrect control of resource identifiers. This can allow a remote attacker to impact the integrity and availability of protected information. The problem occurs when the original iopt area has filled a domain and is linked to domains itree, and pages nodes are not properly reinserted, causing domains itree to become corrupted and resulting in a use-after-free (UAF) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Improper Access Control

Weakness Enumeration

CWE-416

CWE-284

CWE-99

Related Identifiers

ALSA-2024:6567

ALSA-2025_16880

BDU:2024-10184

CVE-2023-52801

INFSA-2024_6567

RHSA-2024:6567

RHSA-2024_6567

RLSA-2024:6567

RXSA-2024:6567

SUSE-SU-2024:2571-1

SUSE-SU-2024:2896-1

SUSE-SU-2024:2973-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

Affected Products

Almalinux

Linux Kernel

Red Hat

Red Os

Rocky Linux

Suse

References · 2016

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52801.json · Exploit
• https://errata.rockylinux.org/RLSA-2024:6567 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-52801 · Vendor Advisory
• https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:20028-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:6567 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2571-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-6567.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52801 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-52801 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52801 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20008-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52801 · Vendor Advisory
• https://osv.dev/vulnerability/RXSA-2024:6567 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-6567.html · Vendor Advisory