PT-2025-40759 · Linux+3 · Linux Kernel+3
Published
2024-11-12
·
Updated
2026-05-26
·
CVE-2023-53596
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the device resource management within the drivers base code. Specifically, device resources are not always freed when a device is unregistered, particularly in scenarios involving bus-less or driver-less devices. This occurs because the
devres release all() function, responsible for releasing these resources, is not consistently called during device unregistration. The issue arises when a managed resource holds a reference to the device, preventing proper cleanup. The fix involves calling devres release all() in the device del() function to ensure resources are released even without a bus or driver. This change combines previous commits to address resource leaks effectively.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linux Kernel
Red Hat
Suse