PT-2025-37697 · Linux+2 · Linux Kernel+2

Published 2025-09-15 · Updated 2026-04-14 · CVE-2023-53256

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the arm ffa firmware where the device naming scheme for logical partitions fails to uniquely identify multiple services within a physical partition. The current implementation uses only the VM ID in the device name, while both VM ID and UUID are maintained in the partition information. This results in duplicate filenames in the sysfs directory, preventing the registration of multiple logical partitions or services. The kernel logs an error message indicating a naming conflict, specifically referencing /devices/arm-ffa-8001. The fix involves allocating a unique ID using ida alloc() and appending it to "arm-ffa" to create a unique device name, storing the ID value in ffa dev for later release.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2026-05884

CVE-2023-53256

RHSA-2024:2394

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53256.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2023-53256 · Vendor Advisory
• https://git.kernel.org/stable/c/19b8766459c41c6f318f8a548cc1c66dffd18363 · Patch
• https://git.kernel.org/stable/c/dfc5aaa57f52a5800c339369d235fa30fb734feb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53256 · Security Note
• https://git.kernel.org/stable/c/c2f65991097a62efbdb2bed3c06fc86b08c9593b · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53256 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53256 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53256 · Security Note
• https://ubuntu.com/security/CVE-2023-53256 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53256 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05884 · Security Note
• https://git.kernel.org/stable/c/93d0cbe88118fcef234d3ebcbdadcb9ebe9d34f1 · Patch
• https://osv.dev/vulnerability/CVE-2023-53256 · Vendor Advisory
• https://twitter.com/CVEnew/status/1969482361130926543 · Twitter Post