CVE-2023-52509

ravb: Fix use-after-free issue in ravb_tx_timeout_work()

State: Published
Severity: 7.8 High
Published: Mar 2, 2024
Updated: Aug 5, 2026
Reserved: Feb 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ravb: Fix use-after-free issue in ravb_tx_timeout_work()

The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below:

CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv

unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c156633f1353264634135dea86ffcae74f2122fc to before 65d34cfd4e347054eb4193bc95d9da7eaa72dee5Affected c156633f1353264634135dea86ffcae74f2122fc to before db9aafa19547833240f58c2998aed7baf414dc82Affected c156633f1353264634135dea86ffcae74f2122fc to before 616761cf9df9af838c0a1a1232a69322a9eb67e6Affected c156633f1353264634135dea86ffcae74f2122fc to before 6f6fa8061f756aedb93af12a8a5d3cf659127965Affected c156633f1353264634135dea86ffcae74f2122fc to before 105abd68ad8f781985113aee2e92e0702b133705Affected c156633f1353264634135dea86ffcae74f2122fc to before 3971442870713de527684398416970cf025b4f89Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.4.259 through 5.4.Not affected 5.10.199 through 5.10.Not affected 5.15.136 through 5.15.Not affected 6.1.59 through 6.1.Not affected 6.5.8 through 6.5.*Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

c156633f1353264634135dea86ffcae74f2122fc to before 65d34cfd4e347054eb4193bc95d9da7eaa72dee5Affected
c156633f1353264634135dea86ffcae74f2122fc to before db9aafa19547833240f58c2998aed7baf414dc82Affected
c156633f1353264634135dea86ffcae74f2122fc to before 616761cf9df9af838c0a1a1232a69322a9eb67e6Affected
c156633f1353264634135dea86ffcae74f2122fc to before 6f6fa8061f756aedb93af12a8a5d3cf659127965Affected
c156633f1353264634135dea86ffcae74f2122fc to before 105abd68ad8f781985113aee2e92e0702b133705Affected
c156633f1353264634135dea86ffcae74f2122fc to before 3971442870713de527684398416970cf025b4f89Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.4.259 through 5.4.*Not affected
5.10.199 through 5.10.*Not affected
5.15.136 through 5.15.*Not affected
6.1.59 through 6.1.*Not affected
6.5.8 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.