CVE-2023-53674 (GCVE-0-2023-53674)
Vulnerability from cvelistv5
Published
2025-10-07 15:21
Modified
2026-08-05 09:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register() allocates a devres resource for clk notifier but didn't register that to the device, so the notifier didn't get unregistered on device detach and the allocated resource was leaked. Fix the issue by registering the resource through devres_add(). This issue was found with kmemleak on a Chromebook.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163
Version: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163
Version: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163
Version: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163
Version: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a326cf0107b197e649bbaa2a2b1355894826ce32",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "49451db71b746df990888068961f1033f7c9b734",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "cb1b04fd4283fc8f9acefe0ddc61ba072ed44877",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "efbbda79b2881a04dcd0e8f28634933d79e17e49",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.39",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix memory leak in devm_clk_notifier_register()\n\ndevm_clk_notifier_register() allocates a devres resource for clk\nnotifier but didn\u0027t register that to the device, so the notifier didn\u0027t\nget unregistered on device detach and the allocated resource was leaked.\n\nFix the issue by registering the resource through devres_add().\n\nThis issue was found with kmemleak on a Chromebook."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The clk core is reached only through local interfaces \u2014 driver bind/unbind, device probe, and clock rate changes driven by local syscalls (DRM/KMS, ALSA, devfreq, IIO sysfs). There is no path from a remote peer or network packet into `devm_clk_notifier_register()` or `__clk_notify()`.\nAC:L - No race or improbable memory layout is required: once the notifier is left registered, `notifier_count` stays permanently incremented so `__clk_notify()` is guaranteed to walk the stale list entry and dereference the freed `struct clk` on the next rate change, which a local attacker can induce reliably via ordinary GPU/audio/cpufreq activity.\nPR:L - The dangling notifier arises without any attacker privilege \u2014 a probe failure after `devm_clk_notifier_register()` (e.g. `adf4377_probe()`, tegra `pmc`, xlnx clock wizard) leaves it registered at boot \u2014 and an ordinary unprivileged user then reaches the use-after-free by causing any clock rate change and by spraying the freed devm allocation.\nUI:N - No victim action is needed; the stale notifier is left behind automatically on detach or probe failure, and the UAF fires from background clock rate changes with no interaction.\nS:U - The freed memory, the notifier chain, and the resulting corruption are all within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `__clk_notify()` reads through the freed `cn-\u003eclk` pointer on every rate change, and control of the reallocated object plus the callback\u0027s dereference of `mux_nb-\u003eops` yields an arbitrary-read primitive over kernel memory.\nI:H - The stale `notifier_block` is invoked through `srcu_notifier_call_chain()` after its containing devm allocation is freed, so heap spraying gives the attacker a controlled indirect call (`mux_nb-\u003eops-\u003eget_parent`) and hence control-flow hijack and arbitrary write.\nA:H - Beyond the unbounded devres/`clk_notifier` leak, the use-after-free dereference of the freed `struct clk` and the call through freed function pointers reliably oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:27.585Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32"
        },
        {
          "url": "https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877"
        },
        {
          "url": "https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff"
        }
      ],
      "title": "clk: Fix memory leak in devm_clk_notifier_register()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53674",
    "datePublished": "2025-10-07T15:21:30.320Z",
    "dateReserved": "2025-10-07T15:16:59.663Z",
    "dateUpdated": "2026-08-05T09:15:27.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.