CVE-2023-53039
published 2025-05-02CVE-2023-53039: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
7.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= ae02e5d40d5f829c589412c6253f925e35cf7a22 < 8c1d378b8c224fd50247625255f09fc01dcc5836 | 8c1d378b8c224fd50247625255f09fc01dcc5836 |
| linux | linux | >= ae02e5d40d5f829c589412c6253f925e35cf7a22 < 0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5 | 0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5 |
| linux | linux | >= ae02e5d40d5f829c589412c6253f925e35cf7a22 < d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0 | d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0 |
| linux | linux | >= ae02e5d40d5f829c589412c6253f925e35cf7a22 < 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 | 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 4.9 < 5.15.105 | 5.15.105 |
| linux | linux_kernel | >= 5.16 < 6.1.22 | 6.1.22 |
| linux | linux_kernel | >= 6.2 < 6.2.9 | 6.2.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
vendor_redhat·2025-05-02·CVSS 7.8
CVE-2023-53039 [HIGH] CWE-825 kernel: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
kernel: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Ha
Debian
CVE-2023-53039: linux - In the Linux kernel, the following vulnerability has been resolved: HID: intel-...
vendor_debian·2023·CVSS 7.8
CVE-2023-53039 [HIGH] CVE-2023-53039: linux - In the Linux kernel, the following vulnerability has been resolved: HID: intel-...
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails.
Scope: local
bookworm: resolved (fixed in 6.1.25-1)
bullseye: open
forky: resolved (fixed in 6.1.25-1)
sid: resolved (fixed in 6.1.25-1)
trixie: resolved (fixed in 6.1.25-1)
OSV
CVE-2023-53039: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a rese
osv·2025-05-02·CVSS 7.8
CVE-2023-53039 [HIGH] CVE-2023-53039: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a rese
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails.
GHSA
GHSA-2352-43vg-7vcc: In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a re
ghsa_unreviewed·2025-05-02
CVE-2023-53039 [HIGH] CWE-416 GHSA-2352-43vg-7vcc: In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a re
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.
No detection rules found.
No public exploits indexed.
2025-05-02
Published