CVE-2023-53758
published 2025-12-08CVE-2023-53758: In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() An early…
PriorityP420
EPSS
0.18%
7.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
An early error exit in atmel_qspi_remove() doesn't prevent the device
unbind. So this results in an spi controller with an unbound parent
and unmapped register space (because devm_ioremap_resource() is undone).
So using the remaining spi controller probably results in an oops.
Instead unregister the controller unconditionally and only skip hardware
access and clk disable.
Also add a warning about resume failing and return zero unconditionally.
The latter has the only effect to suppress a less helpful error message by
the spi core.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336 < f6974fb20499e3b6522daa7aec822aac11dfcf42 | f6974fb20499e3b6522daa7aec822aac11dfcf42 |
| linux | linux | >= 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336 < 618770d4d8e40b7f8ed9eb5f210cd9164dfac47d | 618770d4d8e40b7f8ed9eb5f210cd9164dfac47d |
| linux | linux | >= 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336 < 77806d7c9bebe40a8cdce2b8d30fbe6511745df8 | 77806d7c9bebe40a8cdce2b8d30fbe6511745df8 |
| linux | linux | >= 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336 < 9448bc1dee65f86c0fe64d9dea8b410af0586886 | 9448bc1dee65f86c0fe64d9dea8b410af0586886 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 6.0.0 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 6.2.0 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3.0 < 6.3.2 | 6.3.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c2v7-4942-cq2h: In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in
ghsa_unreviewed·2025-12-08
CVE-2023-53758 GHSA-c2v7-4942-cq2h: In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in
In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
An early error exit in atmel_qspi_remove() doesn't prevent the device
unbind. So this results in an spi controller with an unbound parent
and unmapped register space (because devm_ioremap_resource() is undone).
So using the remaining spi controller probably results in an oops.
Instead unregister the controller unconditionally and only skip hardware
access and clk disable.
Also add a warning about resume failing and return zero unconditionally.
The latter has the only effect to suppress a less helpful error message by
the spi core.
OSV
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
osv·2025-12-08
CVE-2023-53758 spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
An early error exit in atmel_qspi_remove() doesn't prevent the device
unbind. So this results in an spi controller with an unbound parent
and unmapped register space (because devm_ioremap_resource() is undone).
So using the remaining spi controller probably results in an oops.
Instead unregister the controller unconditionally and only skip hardware
access and clk disable.
Also add a warning about resume failing and return zero unconditionally.
The latter has the only effect to suppress a less helpful error message by
the spi core.
OSV
CVE-2023-53758: In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in
osv·2025-12-08
CVE-2023-53758 CVE-2023-53758: In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in
In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() An early error exit in atmel_qspi_remove() doesn't prevent the device unbind. So this results in an spi controller with an unbound parent and unmapped register space (because devm_ioremap_resource() is undone). So using the remaining spi controller probably results in an oops. Instead unregister the controller unconditionally and only skip hardware access and clk disable. Also add a warning about resume failing and return zero unconditionally. The latter has the only effect to suppress a less helpful error message by the spi core.
Red Hat
kernel: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
vendor_redhat·2025-12-08
CVE-2023-53758 kernel: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
kernel: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
In the Linux kernel, the following vulnerability has been resolved:
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
An early error exit in atmel_qspi_remove() doesn't prevent the device
unbind. So this results in an spi controller with an unbound parent
and unmapped register space (because devm_ioremap_resource() is undone).
So using the remaining spi controller probably results in an oops.
Instead unregister the controller unconditionally and only skip hardware
access and clk disable.
Also add a warning about resume failing and return zero unconditionally.
The latter has the only effect to suppress a less helpful error message by
the spi core.
Package: kernel (Red Hat Ente
Debian
CVE-2023-53758: linux - In the Linux kernel, the following vulnerability has been resolved: spi: atmel-...
vendor_debian·2023
CVE-2023-53758 CVE-2023-53758: linux - In the Linux kernel, the following vulnerability has been resolved: spi: atmel-...
In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() An early error exit in atmel_qspi_remove() doesn't prevent the device unbind. So this results in an spi controller with an unbound parent and unmapped register space (because devm_ioremap_resource() is undone). So using the remaining spi controller probably results in an oops. Instead unregister the controller unconditionally and only skip hardware access and clk disable. Also add a warning about resume failing and return zero unconditionally. The latter has the only effect to suppress a less helpful error message by the spi core.
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: resolved
forky: resolved (fixed in 6.3.7-1)
sid: resolv
No detection rules found.
No public exploits indexed.
2025-12-08
Published