CVE-2023-52469

drivers/amd/pm: fix a use-after-free in kv_parse_power_table

State: Published
Severity: 7.8 High
Published: Feb 25, 2024
Updated: Aug 5, 2026
Reserved: Feb 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

drivers/amd/pm: fix a use-after-free in kv_parse_power_table

When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains:

kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini

The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 8a27d9d9fc9b5564b8904c3a77a7dea482bfa34eAffected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 8b55b06e737feb2a645b0293ea27e38418876d63Affected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 520e213a0b97b64735a13950e9371e0a5d7a5dc3Affected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before b6dcba02ee178282e0d28684d241e0b8462dea6aAffected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 35fa2394d26e919f63600ce631e6aefc95ec2706Affected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 95084632a65d5c0d682a83b55935560bdcd2a1e3Affected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 3426f059eacc33ecc676b0d66539297e1cfafd02Affected a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 28dd788382c43b330480f57cd34cde0840896743Affected
LinuxLinux	4.2Affected before 4.2Not affected 4.19.306 through 4.19.Not affected 5.4.268 through 5.4.Not affected 5.10.209 through 5.10.Not affected 5.15.148 through 5.15.Not affected 6.1.75 through 6.1.Not affected 6.6.14 through 6.6.Not affected 6.7.2 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 8a27d9d9fc9b5564b8904c3a77a7dea482bfa34eAffected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 8b55b06e737feb2a645b0293ea27e38418876d63Affected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 520e213a0b97b64735a13950e9371e0a5d7a5dc3Affected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before b6dcba02ee178282e0d28684d241e0b8462dea6aAffected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 35fa2394d26e919f63600ce631e6aefc95ec2706Affected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 95084632a65d5c0d682a83b55935560bdcd2a1e3Affected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 3426f059eacc33ecc676b0d66539297e1cfafd02Affected
a2e73f56fa6282481927ec43aa9362c03c2e2104 to before 28dd788382c43b330480f57cd34cde0840896743Affected

LinuxLinux

4.2Affected
before 4.2Not affected
4.19.306 through 4.19.*Not affected
5.4.268 through 5.4.*Not affected
5.10.209 through 5.10.*Not affected
5.15.148 through 5.15.*Not affected
6.1.75 through 6.1.*Not affected
6.6.14 through 6.6.*Not affected
6.7.2 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.