{"id":"CVE-2023-53484","revision":"f5dce29a8a6948ada0a15bedcadf54f0","records":[{"revision":"f5dce29a8a6948ada0a15bedcadf54f0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-53484","aliases":[],"title":"lib: cpu_rmap: Avoid use after free on rmap->obj array entries","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlib: cpu_rmap: Avoid use after free on rmap->obj array entries\n\nWhen calling irq_set_affinity_notifier() with NULL at the notify\nargument, it will cause freeing of the glue pointer in the\ncorresponding array entry but will leave the pointer in the array. A\nsubsequent call to free_irq_cpu_rmap() will try to free this entry again\nleading to possible use after free.\n\nFix that by setting NULL to the array entry and checking that we have\nnon-zero at the array entry when iterating over the array in\nfree_irq_cpu_rmap().\n\nThe current code does not suffer from this since there are no cases\nwhere irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the\nnotify arg) is called, followed by a call to free_irq_cpu_rmap() so we\ndon't hit and issue. Subsequent patches in this series excersize this\nflow, hence the required fix.","state":0,"publishedAt":"2025-10-01T11:42:52.59+00:00","modifiedAt":"2026-10-15T21:41:28.75+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"lib/cpu_rmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"981f339d2905b6a92ef59358158b326493aecac5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"d1308bd0b24cb1d78fa2747d5fa3e055cc628a48\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"cc2d2b3dbfb0ba57bc027fb7e1121250c50e4000\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"f748e15253833b771acbede14ea98f50831ac289\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"c6ed54dd90698dc0744d669524cc1c122ded8a16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"c9115f49cf260d24d8b5f2d9a4b63cb31a627bb4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"67bca5f1d644f4e79b694abd8052a177de81c37f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"896f97ea95c1d29c0520ee0766b66b7f64cb967c\",\n                            \"lessThan\": \"4e0473f1060aa49621d40a113afde24818101d37\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"lib/cpu_rmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.316\",\n                            \"lessThanOrEqual\": \"4.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.284\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.244\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.181\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.113\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.30\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.3.4\",\n                            \"lessThanOrEqual\": \"6.3.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.4\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/981f339d2905b6a92ef59358158b326493aecac5","https://git.kernel.org/stable/c/d1308bd0b24cb1d78fa2747d5fa3e055cc628a48","https://git.kernel.org/stable/c/cc2d2b3dbfb0ba57bc027fb7e1121250c50e4000","https://git.kernel.org/stable/c/f748e15253833b771acbede14ea98f50831ac289","https://git.kernel.org/stable/c/c6ed54dd90698dc0744d669524cc1c122ded8a16","https://git.kernel.org/stable/c/c9115f49cf260d24d8b5f2d9a4b63cb31a627bb4","https://git.kernel.org/stable/c/67bca5f1d644f4e79b694abd8052a177de81c37f","https://git.kernel.org/stable/c/4e0473f1060aa49621d40a113afde24818101d37"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53484","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-53484","identifiers":["CVE-2023-53484"]},"retained":false,"historicalAffected":[]}],"coverage":[]}