CVE-2023-53314

fbdev/ep93xx-fb: Do not assign to struct fb_info.dev

State: Published
Severity: 7.8 High
Published: Sep 16, 2025
Updated: Aug 5, 2026
Reserved: Sep 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev/ep93xx-fb: Do not assign to struct fb_info.dev

Do not assing the Linux device to struct fb_info.dev. The call to register_framebuffer() initializes the field to the fbdev device. Drivers should not override its value.

Fixes a bug where the driver incorrectly decreases the hardware device's reference counter and leaks the fbdev device.

v2: * add Fixes tag (Dan)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	88017bda96a5fd568a982b01546c8fb1782dda62 to before ffdf2b020db717853167391a3a8d912e13428fa6Affected 88017bda96a5fd568a982b01546c8fb1782dda62 to before 1c6ff2a7c593db851f23e31ace2baf557ea9d0ffAffected 88017bda96a5fd568a982b01546c8fb1782dda62 to before 8ffa40ff64aa43a9a28fcf209b48d86a3e0f4972Affected 88017bda96a5fd568a982b01546c8fb1782dda62 to before 4aade6c9100a3537788b6a9c7ac481037d19efdfAffected 88017bda96a5fd568a982b01546c8fb1782dda62 to before 309c27162afea79b3c7f8747bb650faf6923b639Affected 88017bda96a5fd568a982b01546c8fb1782dda62 to before f83c1b13f8154e0284448912756d0a351a1a602aAffected 88017bda96a5fd568a982b01546c8fb1782dda62 to before 0517fc5a71333b315164736bbd32608894fbb872Affected 88017bda96a5fd568a982b01546c8fb1782dda62 to before f90a0e5265b60cdd3c77990e8105f79aa2fac994Affected
LinuxLinux	2.6.32Affected before 2.6.32Not affected 4.14.326 through 4.14.Not affected 4.19.295 through 4.19.Not affected 5.4.257 through 5.4.Not affected 5.10.195 through 5.10.Not affected 5.15.132 through 5.15.Not affected 6.1.54 through 6.1.Not affected 6.5.4 through 6.5.*Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

88017bda96a5fd568a982b01546c8fb1782dda62 to before ffdf2b020db717853167391a3a8d912e13428fa6Affected
88017bda96a5fd568a982b01546c8fb1782dda62 to before 1c6ff2a7c593db851f23e31ace2baf557ea9d0ffAffected
88017bda96a5fd568a982b01546c8fb1782dda62 to before 8ffa40ff64aa43a9a28fcf209b48d86a3e0f4972Affected
88017bda96a5fd568a982b01546c8fb1782dda62 to before 4aade6c9100a3537788b6a9c7ac481037d19efdfAffected
88017bda96a5fd568a982b01546c8fb1782dda62 to before 309c27162afea79b3c7f8747bb650faf6923b639Affected
88017bda96a5fd568a982b01546c8fb1782dda62 to before f83c1b13f8154e0284448912756d0a351a1a602aAffected
88017bda96a5fd568a982b01546c8fb1782dda62 to before 0517fc5a71333b315164736bbd32608894fbb872Affected
88017bda96a5fd568a982b01546c8fb1782dda62 to before f90a0e5265b60cdd3c77990e8105f79aa2fac994Affected

LinuxLinux

2.6.32Affected
before 2.6.32Not affected
4.14.326 through 4.14.*Not affected
4.19.295 through 4.19.*Not affected
5.4.257 through 5.4.*Not affected
5.10.195 through 5.10.*Not affected
5.15.132 through 5.15.*Not affected
6.1.54 through 6.1.*Not affected
6.5.4 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.