Riskcovery

CVE-2023-52795

vhost-vdpa: fix use after free in vhost_vdpa_probe()

State
Published
Severity
Not scored
Published
May 21, 2024
Updated
May 11, 2026
Reserved
May 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: fix use after free in vhost_vdpa_probe()

The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 to before c0f8b8fb7df9d1a38652eb5aa817afccd3c56111Affected
  • ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 to before ae8ea4e200675a940c365b496ef8e3fb4123601cAffected
  • ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 to before bf04132cd64ccde4e9e9765d489c83fe83c09b7fAffected
  • ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 to before e07754e0a1ea2d63fb29574253d1fd7405607343Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.64 through 6.1.*Not affected
  • 6.5.13 through 6.5.*Not affected
  • 6.6.3 through 6.6.*Not affected
  • 6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.