CVE-2023-53674Missing Release of Memory after Effective Lifetime in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 97.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 7

Description

In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register() allocates a devres resource for clk notifier but didn't register that to the device, so the notifier didn't get unregistered on device detach and the allocated resource was leaked. Fix the issue by registering the resource through devres_add(). This issue was found with kmemleak on a Chromebook.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

NVDlinux/linux_kernel5.115.15.121+3
Debianlinux/linux_kernel< 6.1.52-1+2
CVEListV5linux/linux6d30d50d037dfa092f9d5d1fffa348ab4abb7163a326cf0107b197e649bbaa2a2b1355894826ce32+5
debiandebian/linux< linux 6.1.52-1 (bookworm)

Patches

🔴Vulnerability Details

2
GHSA
GHSA-wxm3-66f2-8xfm: In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register(2025-10-07
OSV
CVE-2023-53674: In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register()2025-10-07

📋Vendor Advisories

2
Red Hat
kernel: clk: Fix memory leak in devm_clk_notifier_register()2025-10-07
Debian
CVE-2023-53674: linux - In the Linux kernel, the following vulnerability has been resolved: clk: Fix me...2023