CVE-2023-53515
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-01 12:15:55.583000
Last modified
2026-11-05 21:17:24.120000
View original CVE JSON
{
"id": "CVE-2023-53515",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-01T12:15:55.583",
"lastModified": "2026-11-05T21:17:24.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-mmio: don't break lifecycle of vm_dev\n\nvm_dev has a separate lifecycle because it has a 'struct device'\nembedded. Thus, having a release callback for it is correct.\n\nAllocating the vm_dev struct with devres totally breaks this protection,\nthough. Instead of waiting for the vm_dev release callback, the memory\nis freed when the platform_device is removed. Resulting in a\nuse-after-free when finally the callback is to be called.\n\nTo easily see the problem, compile the kernel with\nCONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.\n\nThe fix is easy, don't use devres in this case.\n\nFound during my research about object lifetime problems."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/virtio/virtio_mmio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "97a2d55ead76358245b446efd87818e919196d7a",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "b788ad3b2468512339c05f23692e36860264e674",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "3ff54d904fafabd0912796785e53cce4e69ca123",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "af5818c35173e096085c6ae2e3aac605d3d15e41",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e",
"versionType": "git",
"status": "affected"
},
{
"version": "7eb781b1bbb7136fe78fb8c28c1c223c61fa32b5",
"lessThan": "55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/virtio/virtio_mmio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "4.19.293",
"lessThanOrEqual": "4.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.255",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.192",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.128",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.47",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.4.12",
"lessThanOrEqual": "6.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.5",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:22:52.394274Z",
"id": "CVE-2023-53515",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.15.1",
"versionEndExcluding": "4.19.293",
"matchCriteriaId": "ED6316DD-6C72-425B-A7D4-EA2D57F6124C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20",
"versionEndExcluding": "5.4.255",
"matchCriteriaId": "1379E40A-2AC3-484E-929A-7F46B6C3B521"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.10.192",
"matchCriteriaId": "9396FFDC-6A0D-44B7-9368-21B456F6D4AE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.128",
"matchCriteriaId": "1415629F-F97B-4880-BA1E-AF3DBB8EF305"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.47",
"matchCriteriaId": "2EEA01B0-0151-4E0F-B140-1A441EEDD717"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.4.12",
"matchCriteriaId": "CF8ECF64-40AE-49AB-8315-4D83F9F56ECF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*",
"matchCriteriaId": "3B4D39AF-668B-442B-8085-639A6D4FA5AC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "14E8986E-B317-40EA-B0B5-5D2922D2AF5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc4:*:*:*:*:*:*",
"matchCriteriaId": "EBC4657A-0239-47DF-B582-87D8DFA69439"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc5:*:*:*:*:*:*",
"matchCriteriaId": "0E1F48A9-9185-4554-9265-22CEC01D18FD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc6:*:*:*:*:*:*",
"matchCriteriaId": "639D2465-65E0-40E2-B7A8-BEA9E221DE54"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc7:*:*:*:*:*:*",
"matchCriteriaId": "A282AD0B-2D63-4F05-8F89-109A0975B423"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc8:*:*:*:*:*:*",
"matchCriteriaId": "30358221-183C-4699-994E-AF51F5D534FC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.15:rc9:*:*:*:*:*:*",
"matchCriteriaId": "A5ED80A8-E656-4AE9-921B-C22402C94A4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*",
"matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*",
"matchCriteriaId": "6F15C659-DF06-455A-9765-0E6DE920F29A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:*",
"matchCriteriaId": "5B1C14ED-ABC4-41D3-8D9C-D38C6A65B4DE"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2dcb368fe5a8eee498ca75c93a18ce2f3b0d6a8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3ff54d904fafabd0912796785e53cce4e69ca123",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5b7d5c2dd664eb8b9a06ecbc06e28d39359c422e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/97a2d55ead76358245b446efd87818e919196d7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/af5818c35173e096085c6ae2e3aac605d3d15e41",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b788ad3b2468512339c05f23692e36860264e674",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}