CVE-2023-53363 — Use After Free in Linux

CWE-416 — Use After Free5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 95.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedSep 17

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") introduced a use-after-free bug in the bus removal cleanup. The issue was found with kfence: [ 19.293351] BUG: KFENCE: use-after-free read in pci_bus_release_domain_nr+0x10/0x70 [ 19.302817] Use-after-free read at 0x000000007f3b80eb (in kfence-#115): [ 19.309677] pci_bus_release_domain_nr+0x10/0x70 [ 19.30…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel6.2 — 6.2.12+1
▶Debianlinux/linux_kernel< 5.10.237-1+3
▶CVEListV5linux/linuxf8b6bd6c04d4dfc4c200e6fa306e61e3b42ec5fc — 52b0343c7d628f37b38e3279ba585526b850ad3b+5
▶debiandebian/linux< linux 6.1.137-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-2j59-jjwx-7c79: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI↗2025-09-17
▶
OSV
CVE-2023-53363: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI:↗2025-09-17
▶

📋Vendor Advisories

2
Red Hat
kernel: PCI: Fix use-after-free in pci_bus_release_domain_nr()↗2025-09-17
▶
Debian
CVE-2023-53363: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: Fix us...↗2023
▶
CVE-2023-53363 — Use After Free in Linux | cvebase