Riskcovery

CVE-2023-53479

cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()

State
Published
Severity
Not scored
Published
Oct 1, 2025
Updated
May 11, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()

KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following error:

BUG: KASAN: slab-use-after-free in cxl_parse_cfmws (drivers/cxl/acpi.c:299)

This happens in cxl_parse_cfmws(), where put_device() is called, releasing cxld, which is accessed later.

Use the local variables in the dev_err() instead of pointing to the released memory. Since the dev_err() is printing a resource, change the open coded print format to use the %pr format specifier.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e50fe01e1f2a4aba2275edee7d5c77ac87674ddb to before 748fadc08bcbdaf573b34d9784bb3dbd87441dbfAffected
  • e50fe01e1f2a4aba2275edee7d5c77ac87674ddb to before 316db489647b8ddc381682597e89787eac61a278Affected
  • e50fe01e1f2a4aba2275edee7d5c77ac87674ddb to before 4cf67d3cc9994a59cf77bb9c0ccf9007fe916afeAffected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.43 through 6.1.*Not affected
  • 6.4.8 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.