CVE-2023-53596
7.8 HIGHIn the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In t...
Published: 2025-10-04 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 7.8 HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-415
Affected products
| Vendor | Product |
|---|---|
| linux | linux_kernel |
Description
In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues when using bus-less or driver-less devices where the device might never get freed if a managed resource holds a reference to the device. This is happening in the DRM framework for example. We should thus call devres_release_all() in the device_del() function to make sure that the device-managed actions are properly executed when the device is unregistered, even if it has neither a bus nor a driver. This is effectively the same change than commit 2f8d16a996da ("devres: release resources on device_del()") that got reverted by commit a525a3ddeaca ("driver core: free devres in device_release") over memory leaks concerns. This patch effectively combines the two commits mentioned above to release the resources both on device_del() and device_release() and get the best of both worlds.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2023-53596
- [Patch]https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9
- [Patch]https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd
- [Patch]https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3
- [Other]https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511
- [Other]https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3
- [Patch]https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038
Related CVEs
Same vendor
- CVE-2026-46273 — In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapt... (8.6 HIGH)
- CVE-2026-46272 — In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode ... (4.7 MEDIUM)
- CVE-2026-46271 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi... (7.8 HIGH)
- CVE-2026-46270 — In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() ... (8.4 HIGH)
- CVE-2026-46269 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference when parsing dev... (5.5 MEDIUM)
Same CWE
- CVE-2026-12043 — Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor oper... (8.8 HIGH)
- CVE-2026-46690 — unbounded_spsc is an "unbounded" extension of bounded_spsc_queue (5.8 MEDIUM)
- CVE-2026-35188 — Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, tr... (5.0 MEDIUM)
- CVE-2026-45324 — Rizin is a UNIX-like reverse engineering framework and command-line toolset (3.3 LOW)
- CVE-2026-44422 — FreeRDP is a free implementation of the Remote Desktop Protocol (7.5 HIGH)