PT-2025-40775 · Linux+2 · Linux Kernel+2

Published 2024-04-30 · Updated 2025-12-04 · CVE-2023-53612

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The coretemp platform driver in the Linux kernel has a design flaw related to platform device handling. The driver's unconventional approach of dynamically creating and destroying platform devices can lead to a NULL dereference if drivers autoprobe is disabled for the platform bus. This also causes lock dependency issues for other drivers or subsystems registering CPU hotplug notifiers from a platform bus notifier, and can cause deadlocks during suspend. The issue is addressed by tying platform devices to the module's lifetime and directly managing hwmon interfaces from hotplug notifiers. This change removes the /sys/bus/platform/drivers/coretemp directory, while /sys/devices/platform/coretemp.n remains if package n is hotplugged off, but the behavior of hwmon interfaces remains unchanged.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

CVE-2023-53612

RHSA-2024:2394

RHSA-2024_2394

SUSE-SU-2025:4111-1

SUSE-SU-2025:4139-1

SUSE-SU-2025:4149-1

SUSE-SU-2025:4320-1

Affected Products

Linux Kernel

Red Hat

Suse

References · 451

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53612.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:4149-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53612 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4111-1 · Vendor Advisory
• https://git.kernel.org/stable/c/52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4139-1 · Vendor Advisory
• https://git.kernel.org/stable/c/8fcdbc4bc01365f4b10fed7db544a3149e3054fd · Patch
• https://ubuntu.com/security/CVE-2023-53612 · Vendor Advisory
• https://git.kernel.org/stable/c/6d03bbff456befeccdd4d663177c4d6c75d0c4ff · Patch
• https://osv.dev/vulnerability/CVE-2023-53612 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53612 · Vendor Advisory
• https://git.kernel.org/stable/c/c57a8d14d7880521150ee801d53a0a64fdffd9c8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53612 · Vendor Advisory
• https://git.kernel.org/stable/c/5735878a7b7db7e9ce731cb36cec298a9de67549 · Patch
• https://cve.org/CVERecord?id=CVE-2023-53612 · Security Note