CVE-2023-54308 — Incomplete Cleanup in Linux
Severity
4.7MEDIUM
No vectorEPSS
0.0%
top 92.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 30
Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA:
ymfpci: Allocate resources with device-managed APIs"), but the call to
snd_card_new() was not replaced with snd_devm_card_new().
Since there was no longer a call to snd_card_free, unloading the module
would eventually result in Oops:
[697561.532887] BUG: unable to handle page fault for address…
Affected Packages4 packages
▶CVEListV5linux/linuxc6e6bb5eab7457a938c0405d5ccf319d3ee735c1 — 95642872c466030240199ba796a40771c493ed0c+4
🔴Vulnerability Details
3GHSA▶
GHSA-3j26-wpvv-9xc2: In the Linux kernel, the following vulnerability has been resolved:
ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
snd_card_ymfpc↗2025-12-30
OSV▶
CVE-2023-54308: In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_card_ymfpci_↗2025-12-30