CVE-2023-53446

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

State: Published
Severity: 7.8 High
Published: Sep 18, 2025
Updated: May 11, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.:

# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy

BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 Call Trace: kasan_report+0xae/0xe0 pcie_config_aspm_link+0x42d/0x500 pcie_aspm_set_policy+0x8e/0x1a0 param_attr_store+0x162/0x2c0 module_attr_store+0x3e/0x80

PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices.

Disable ASPM and free the pcie_link_state when any child function is removed so we can discard the dangling pcie_link_state->downstream pointer and maintain the same ASPM Control configuration for all functions.

[bhelgaas: commit log and comment]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 666e7f9d60cee23077ea3e6331f6f8a19f7ea03fAffected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 7badf4d6f49a358a01ab072bbff88d3ee886c33bAffected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 9856c0de49052174ab474113f4ba40c02aaee086Affected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 7aecdd47910c51707696e8b0e045b9f88bd4230fAffected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before d51d2eeae4ce54d542909c4d9d07bf371a78592cAffected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 4203722d51afe3d239e03f15cc73efdf023a7103Affected b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 456d8aa37d0f56fc9e985e812496e861dcd6f2f2Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.4.251 through 5.4.Not affected 5.10.188 through 5.10.Not affected 5.15.121 through 5.15.Not affected 6.1.39 through 6.1.Not affected 6.3.13 through 6.3.Not affected 6.4.4 through 6.4.Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 666e7f9d60cee23077ea3e6331f6f8a19f7ea03fAffected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 7badf4d6f49a358a01ab072bbff88d3ee886c33bAffected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 9856c0de49052174ab474113f4ba40c02aaee086Affected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 7aecdd47910c51707696e8b0e045b9f88bd4230fAffected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before d51d2eeae4ce54d542909c4d9d07bf371a78592cAffected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 4203722d51afe3d239e03f15cc73efdf023a7103Affected
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06 to before 456d8aa37d0f56fc9e985e812496e861dcd6f2f2Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.4.251 through 5.4.*Not affected
5.10.188 through 5.10.*Not affected
5.15.121 through 5.15.*Not affected
6.1.39 through 6.1.*Not affected
6.3.13 through 6.3.*Not affected
6.4.4 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.