CVE-2023-52795

HIGH

Linux Kernel < 6.1.64 - Use-After-Free in vhost_vdpa_probe

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.

References (4)

Core 4

Scores

CVSS v3 7.8
EPSS 0.0024
EPSS Percentile 15.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-415 CWE-416
Status published
Products (15)
linux/Kernel 6.0.0 - 6.1.64linux
linux/Kernel 6.2.0 - 6.5.13linux
linux/Kernel 6.6.0 - 6.6.3linux
Linux/Linux < 6.0
Linux/Linux 6.0
Linux/Linux 6.1.64 - 6.1.*
Linux/Linux 6.5.13 - 6.5.*
Linux/Linux 6.6.3 - 6.6.*
Linux/Linux 6.7
Linux/Linux ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 - ae8ea4e200675a940c365b496ef8e3fb4123601c
... and 5 more
Published May 21, 2024
Tracked Since Feb 18, 2026