CVE-2023-53003

EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info

State: Published
Severity: 7.8 High
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info

The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug.

Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 66e10d5f399629ef7877304d9ba2b35d0474e7ebAffected 27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 76d9ebb7f0bc10fbc78b6d576751552edf743968Affected 27450653f1db0b9d5b5048a246c850c52ee4aa61 to before bff5243bd32661cf9ce66f6d9210fc8f89bda145Affected 27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 6f0351d0c311951b8b3064db91e61841e85b2b96Affected 27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 977c6ba624f24ae20cf0faee871257a39348d4a9Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.4.231 through 5.4.Not affected 5.10.166 through 5.10.Not affected 5.15.91 through 5.15.Not affected 6.1.9 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 66e10d5f399629ef7877304d9ba2b35d0474e7ebAffected
27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 76d9ebb7f0bc10fbc78b6d576751552edf743968Affected
27450653f1db0b9d5b5048a246c850c52ee4aa61 to before bff5243bd32661cf9ce66f6d9210fc8f89bda145Affected
27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 6f0351d0c311951b8b3064db91e61841e85b2b96Affected
27450653f1db0b9d5b5048a246c850c52ee4aa61 to before 977c6ba624f24ae20cf0faee871257a39348d4a9Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.4.231 through 5.4.*Not affected
5.10.166 through 5.10.*Not affected
5.15.91 through 5.15.*Not affected
6.1.9 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.