CVE-2023-53596

drivers: base: Free devm resources when unregistering a device

HIGH
7.8
CVSS Score
Published: October 4, 2025 at 03:44 PM UTC
Updated: June 18, 2026 at 02:45 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues when using bus-less or driver-less devices where the device might never get freed if a managed resource holds a reference to the device. This is happening in the DRM framework for example. We should thus call devres_release_all() in the device_del() function to make sure that the device-managed actions are properly executed when the device is unregistered, even if it has neither a bus nor a driver. This is effectively the same change than commit 2f8d16a996da ("devres: release resources on device_del()") that got reverted by commit a525a3ddeaca ("driver core: free devres in device_release") over memory leaks concerns. This patch effectively combines the two commits mentioned above to release the resources both on device_del() and device_release() and get the best of both worlds.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.7 ≤ v < 5.10.2583.7 ≤ v < 5.15.2093.7 ≤ v < 6.1.533.7 ≤ v < 6.4.163.7 ≤ v < 6.5.33.7 ≤ v < 6.65.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.536.2 ≤ v < 6.4.166.5 ≤ v < 6.5.33.7a525a3ddeaca69f405d98442ab3c0746e53168dc
Vendor states this is fixed in 297992e5c63528e603666e36081836204fc36ec9 (fixed)
Vendor states this is fixed in 3bcc4c2a096e8342c8c719e595ce15de212694dd (fixed)
Vendor states this is fixed in 699fb50d99039a50e7494de644f96c889279aca3 (fixed)
Vendor states this is fixed in 83e2ec36a92432e9445e853c12becbbae353b511 (fixed)
Vendor states this is fixed in b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3 (fixed)
Vendor states this is fixed in c8c426fae26086a0ca8ab6cc6da2de79810ec038 (fixed)
Vendor states this is fixed in 3.7 (unaffected)
Vendor states this is fixed in 5.10.258 (unaffected)
Vendor states this is fixed in 5.15.209 (unaffected)
Vendor states this is fixed in 6.1.53 (unaffected)
Vendor states this is fixed in 6.4.16 (unaffected)
Vendor states this is fixed in 6.5.3 (unaffected)
Vendor states this is fixed in 6.6 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-415

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card