CVE-2023-53479
HIGH EPSS 4.3%
Published Oct 1, 20259mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
Published Oct 1, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
In the Linux kernel, the following vulnerability has been resolved: cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following error: BUG: KASAN: slab-use-after-free in cxl_parse_cfmws (drivers/cxl/acpi.c:299) This happens in cxl_parse_cfmws(), where put_device() is called, releasing cxld, which is accessed later. Use the local variables in the dev_err() instead of pointing to the released memory. Since the dev_err() is printing a resource, change the open coded print format to use the %pr format specifier.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
4.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-416 Use After Free Memory Safety
Affected Products 5
References 3
- git.kernel.org https://git.kernel.org/stable/c/316db489647b8ddc381682597e89787eac61a278
- git.kernel.org https://git.kernel.org/stable/c/4cf67d3cc9994a59cf77bb9c0ccf9007fe916afe
- git.kernel.org https://git.kernel.org/stable/c/748fadc08bcbdaf573b34d9784bb3dbd87441dbf
Remediation
- git.kernel.org https://git.kernel.org/stable/c/316db489647b8ddc381682597e89787eac61a278
- git.kernel.org https://git.kernel.org/stable/c/4cf67d3cc9994a59cf77bb9c0ccf9007fe916afe
- git.kernel.org https://git.kernel.org/stable/c/748fadc08bcbdaf573b34d9784bb3dbd87441dbf