CVE-2023-53484

lib: cpu_rmap: Avoid use after free on rmap->obj array entries

State
Published
Severity
7.8 High
Published
Oct 1, 2025
Updated
Oct 15, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

lib: cpu_rmap: Avoid use after free on rmap->obj array entries

When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free.

Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap().

The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before 981f339d2905b6a92ef59358158b326493aecac5Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before d1308bd0b24cb1d78fa2747d5fa3e055cc628a48Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before cc2d2b3dbfb0ba57bc027fb7e1121250c50e4000Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before f748e15253833b771acbede14ea98f50831ac289Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before c6ed54dd90698dc0744d669524cc1c122ded8a16Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before c9115f49cf260d24d8b5f2d9a4b63cb31a627bb4Affected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before 67bca5f1d644f4e79b694abd8052a177de81c37fAffected
  • 896f97ea95c1d29c0520ee0766b66b7f64cb967c to before 4e0473f1060aa49621d40a113afde24818101d37Affected
LinuxLinux
  • 3.8Affected
  • before 3.8Not affected
  • 4.14.316 through 4.14.*Not affected
  • 4.19.284 through 4.19.*Not affected
  • 5.4.244 through 5.4.*Not affected
  • 5.10.181 through 5.10.*Not affected
  • 5.15.113 through 5.15.*Not affected
  • 6.1.30 through 6.1.*Not affected
  • 6.3.4 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.