Riskcovery

CVE-2023-53219

media: netup_unidvb: fix use-after-free at del_timer()

State
Published
Severity
7.8 High
Published
Sep 15, 2025
Updated
Aug 5, 2026
Reserved
Sep 15, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

media: netup_unidvb: fix use-after-free at del_timer()

When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:

(cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE

Fix by changing del_timer() to del_timer_sync().

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before dd5c77814f290b353917df329f36de1472d47154Affected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before 90229e9ee957d4514425e4a4d82c50ab5d57ac4dAffected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before 1550bcf2983ae1220cc8ab899a39a423fa7cb523Affected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before f9982db735a8495eee14267cf193c806b957e942Affected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before 051af3f0b7d1cd8ab7f3e2523ad8ae1af44caba3Affected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before 07821524f67bf920342bc84ae8b3dea2a315a89eAffected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before c8f9c05e1ebcc9c7bc211cc8b74d8fb86a8756fcAffected
  • 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e to before 0f5bb36bf9b39a2a96e730bf4455095b50713f63Affected
LinuxLinux
  • 4.3Affected
  • before 4.3Not affected
  • 4.14.316 through 4.14.*Not affected
  • 4.19.284 through 4.19.*Not affected
  • 5.4.244 through 5.4.*Not affected
  • 5.10.181 through 5.10.*Not affected
  • 5.15.113 through 5.15.*Not affected
  • 6.1.30 through 6.1.*Not affected
  • 6.3.4 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.