In the Linux kernel, the following vulnerability has been resolved:
clk: microchip: fix potential UAF in auxdev release callback
Similar to commit 1c11289b34ab ("peci: cpu: Fix use-after-free in
adev_release()"), the auxiliary device is not torn down in the correct
order. If auxiliary_device_add() fails, the release callback will be
called twice, resulting in a UAF. Due to timing, the auxdev code in this
driver "took inspiration" from the aforementioned commit, and thus its
bugs too!
Moving auxiliary_device_uninit() to the unregister callback instead
avoids the issue.
References
Configurations
Configuration 1 (hide)
|
History
03 Feb 2026, 22:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/5b4052aa956e11bcd19e50ca559eb38dcb46201b - Patch | |
| References | () https://git.kernel.org/stable/c/7455b7007b9e93bcc2bc9c1c6c73a228e3152069 - Patch | |
| References | () https://git.kernel.org/stable/c/934406b2d42eaf3fc57f5546cc68ff7ab9680bb3 - Patch | |
| References | () https://git.kernel.org/stable/c/d7d6dacf39ed102d7667721ca1700022c9c8b11a - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
Information
Published : 2025-10-07 16:15
Updated : 2026-02-03 22:30
NVD link : CVE-2023-53636
Mitre link : CVE-2023-53636
CVE.ORG link : CVE-2023-53636
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free