PT-2025-40222 · Linux+1 · Linux Kernel+1
Published
2023-06-29
·
Updated
2026-01-26
·
CVE-2023-53515
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel related to the lifecycle management of
vm dev within the virtio-mmio subsystem. Specifically, using devres for allocating the vm dev structure breaks its intended lifecycle protection. This results in premature memory freeing when the platform device is removed, leading to a use-after-free condition when the vm dev release callback is eventually invoked. The issue arises because vm dev has a separate lifecycle due to the embedded 'struct device', and devres bypasses the expected release callback sequence. The fix involves avoiding the use of devres in this specific case.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Suse