CVE-2023-52795

HIGH

Linux Kernel < 6.1.64 - Use-After-Free in vhost_vdpa_probe

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.

References (4)

Core 4

Scores

CVSS v3 7.8
EPSS 0.0024
EPSS Percentile 15.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-415 CWE-416
Status published
Products (12)
Linux/Linux < 6.0
Linux/Linux 6.0
Linux/Linux 6.1.64 - 6.1.*
Linux/Linux 6.5.13 - 6.5.*
Linux/Linux 6.6.3 - 6.6.*
Linux/Linux 6.7
Linux/Linux ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 - ae8ea4e200675a940c365b496ef8e3fb4123601c
Linux/Linux ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 - bf04132cd64ccde4e9e9765d489c83fe83c09b7f
Linux/Linux ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 - c0f8b8fb7df9d1a38652eb5aa817afccd3c56111
Linux/Linux ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 - e07754e0a1ea2d63fb29574253d1fd7405607343
... and 2 more
Published May 21, 2024
Tracked Since Feb 18, 2026