Executive brief
A vulnerability in the Linux kernel's driver management system could lead to memory leaks or system instability. The issue occurs when certain hardware or software devices are removed from the system but their associated resources are not properly cleaned up. This could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information.
Technical details
A vulnerability exists in the Linux kernel's driver core (drivers/base/core.c) where managed resources (devres) are not properly released during device unregistration for devices without a bus or driver. This occurs because devres_release_all() was historically only called if a device had been probed on a bus. If a managed resource holds a reference to such a device, the device is never freed, leading to a memory leak. The fix involves calling devres_release_all() within device_del() to ensure cleanup occurs even for bus-less devices, while maintaining a secondary call in device_release() to prevent leaks from resources added after unregistration. This flaw is categorized as a potential double-free or use-after-free scenario depending on how drivers interact with the leaked references.
Affected products
- Linux Linux kernel 3.7 to 6.1.53, 6.2 to 6.4.16, 6.5 to 6.5.3
Timeline
- 2023-07-20: other: Initial patch authored
- 2025-10-04: disclosed: CVE published
- 2023-09-13: patched: Patch committed to stable branches
References
- https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9
- https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd
- https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3
- https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511
- https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3
- https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038