CVE-2023-52667

net/mlx5e: fix a potential double-free in fs_any_create_groups

State: Published
Severity: 7.8 High
Published: May 17, 2024
Updated: Aug 5, 2026
Reserved: Mar 7, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix a potential double-free in fs_any_create_groups

When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_any_create_groups() will free ft->g. However, its caller fs_any_create_table() will free ft->g again through calling mlx5e_destroy_flow_table(), which will lead to a double-free. Fix this by setting ft->g to NULL in fs_any_create_groups().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 72a729868592752b5a294d27453da264106983b1Affected 0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before b2fa86b2aceb4bc9ada51cea90f61546d7512cbeAffected 0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 2897c981ee63e1be5e530b1042484626a10b26d8Affected 0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 65a4ade8a6d205979292e88beeb6a626ddbd4779Affected 0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before aef855df7e1bbd5aa4484851561211500b22707eAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.149 through 5.15.Not affected 6.1.76 through 6.1.Not affected 6.6.15 through 6.6.Not affected 6.7.3 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 72a729868592752b5a294d27453da264106983b1Affected
0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before b2fa86b2aceb4bc9ada51cea90f61546d7512cbeAffected
0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 2897c981ee63e1be5e530b1042484626a10b26d8Affected
0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before 65a4ade8a6d205979292e88beeb6a626ddbd4779Affected
0f575c20bf0686caf3d82d6c626c2e1e4a4c36e6 to before aef855df7e1bbd5aa4484851561211500b22707eAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.149 through 5.15.*Not affected
6.1.76 through 6.1.*Not affected
6.6.15 through 6.6.*Not affected
6.7.3 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.