GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53596 (GCVE-0-2023-53596)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-06-01 16:04
VLAI
Title
drivers: base: Free devm resources when unregistering a device
Summary
In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues when using bus-less or driver-less devices where the device might never get freed if a managed resource holds a reference to the device. This is happening in the DRM framework for example. We should thus call devres_release_all() in the device_del() function to make sure that the device-managed actions are properly executed when the device is unregistered, even if it has neither a bus nor a driver. This is effectively the same change than commit 2f8d16a996da ("devres: release resources on device_del()") that got reverted by commit a525a3ddeaca ("driver core: free devres in device_release") over memory leaks concerns. This patch effectively combines the two commits mentioned above to release the resources both on device_del() and device_release() and get the best of both worlds.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 83e2ec36a92432e9445e853c12becbbae353b511 (git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3 (git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 297992e5c63528e603666e36081836204fc36ec9 (git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 3bcc4c2a096e8342c8c719e595ce15de212694dd (git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < c8c426fae26086a0ca8ab6cc6da2de79810ec038 (git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 699fb50d99039a50e7494de644f96c889279aca3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.53 , ≤ 6.1.* (semver)
Unaffected: 6.4.16 , ≤ 6.4.* (semver)
Unaffected: 6.5.3 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c",
            "drivers/base/test/platform-device-test.c",
            "drivers/base/test/root-device-test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83e2ec36a92432e9445e853c12becbbae353b511",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            },
            {
              "lessThan": "b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            },
            {
              "lessThan": "297992e5c63528e603666e36081836204fc36ec9",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            },
            {
              "lessThan": "3bcc4c2a096e8342c8c719e595ce15de212694dd",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            },
            {
              "lessThan": "c8c426fae26086a0ca8ab6cc6da2de79810ec038",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            },
            {
              "lessThan": "699fb50d99039a50e7494de644f96c889279aca3",
              "status": "affected",
              "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c",
            "drivers/base/test/platform-device-test.c",
            "drivers/base/test/root-device-test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:04:17.609Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3"
        },
        {
          "url": "https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038"
        },
        {
          "url": "https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3"
        }
      ],
      "title": "drivers: base: Free devm resources when unregistering a device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53596",
    "datePublished": "2025-10-04T15:44:08.942Z",
    "dateReserved": "2025-10-04T15:40:38.478Z",
    "dateUpdated": "2026-06-01T16:04:17.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53596",
      "date": "2026-09-19",
      "epss": "0.00154",
      "percentile": "0.04998"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/base/core.c",
                  "drivers/base/test/platform-device-test.c",
                  "drivers/base/test/root-device-test.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "83e2ec36a92432e9445e853c12becbbae353b511",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "297992e5c63528e603666e36081836204fc36ec9",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3bcc4c2a096e8342c8c719e595ce15de212694dd",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c8c426fae26086a0ca8ab6cc6da2de79810ec038",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "699fb50d99039a50e7494de644f96c889279aca3",
                    "status": "affected",
                    "version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/base/core.c",
                  "drivers/base/test/platform-device-test.c",
                  "drivers/base/test/root-device-test.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.7"
                  },
                  {
                    "lessThan": "3.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.*",
                    "status": "unaffected",
                    "version": "6.4.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E5E8C954-76D2-41E6-8C01-1844EC5AA2BD",
                    "versionEndExcluding": "5.10.258",
                    "versionStartIncluding": "3.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4",
                    "versionEndExcluding": "5.15.209",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B20754AF-3B8C-4574-A70D-EC24933810E5",
                    "versionEndExcluding": "6.1.53",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3039EA3-F6CA-43EF-9F17-81A7EC6841EF",
                    "versionEndExcluding": "6.4.16",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "880C803A-BEAE-4DA0-8A59-AC023F7B4EE3",
                    "versionEndExcluding": "6.5.3",
                    "versionStartIncluding": "6.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds."
          }
        ],
        "id": "CVE-2023-53596",
        "lastModified": "2026-06-18T14:30:05.657",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-04T16:15:56.153",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:28:59+00:00",
      "cve": "CVE-2023-53596",
      "id": "CVE-2023-53596",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "84",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drivers: base: Free devm resources when unregistering a device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53596.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:48:22Z",
      "cve": "CVE-2023-53596",
      "id": "CVE-2023-53596",
      "initial_release_date": "2025-10-05T02:55:43Z",
      "product_status:known_affected": "651",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53596",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53596.json",
      "version": "53"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.