PT-2025-18902 · Linux+1 · Linux Kernel+1

Published 2023-03-02 · Updated 2025-05-07 · CVE-2023-53138

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc3

Description A use-after-free issue has been identified in the Linux kernel, specifically in the cfusbl device notify() function. This issue occurs when unregistering a net device, which can lead to a stack trace and potentially cause problems. The problem arises when cfusbl device notify() is called multiple times with NETDEV UNREGISTER, causing the parent device to be freed and resulting in a use-after-free error. This also causes an imbalance in the reference count for the module.

Recommendations For Linux kernel versions prior to 5.19.0-rc3, consider applying the patch that fixes the issue by accepting only the first NETDEV UNREGISTER notification. As a temporary workaround, consider restricting the use of the cfusbl device notify() function until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-911

CWE-416

CWE-664

Related Identifiers

BDU:2026-03859

CVE-2023-53138

Affected Products

Astra Linux

Linux Kernel

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53138.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2023-53138 · Vendor Advisory
• https://git.kernel.org/stable/c/9dc16be373b382ddd4c274052a6e870a95e76c01 · Patch
• https://git.kernel.org/stable/c/3f14457e1584224f4296af613bbd99deb60b5d91 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53138 · Vendor Advisory
• https://git.kernel.org/stable/c/d1a11bbdbb5ea9f172019c5a4a3e9d8eabd72179 · Patch
• https://git.kernel.org/stable/c/1793da97a23e31c5bf06631f3f3e5a25f368fd64 · Patch
• https://git.kernel.org/stable/c/c3aaec463a632cf4187dc017e421bfa69d7834a9 · Patch
• https://git.kernel.org/stable/c/287027d8a567168a5d8ce5cb0cba16a34791a48c · Patch
• https://osv.dev/vulnerability/CVE-2023-53138 · Vendor Advisory
• https://git.kernel.org/stable/c/68a45c3cf0e2242a533657f4f535d9b6a7447a79 · Patch
• https://git.kernel.org/stable/c/9781e98a97110f5e76999058368b4be76a788484 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53138 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53138 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03859 · Security Note