7.8

CVE-2023-53596: linux Double Free

CVSS: 7.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2023-53596DEBIAN-CVE-2023-53596
Published 04-10-2025Last modified 01-06-2026
Open JSON

Vulnerability summary

CVE-2023-53596 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 24 · Related 23
RHSA-2024:9315SUSE-SU-2025:21040-1SUSE-SU-2025:21052-1SUSE-SU-2025:21056-1SUSE-SU-2025:21064-1SUSE-SU-2025:4057-1

Timeline

  1. 04-10-2025
    PublishedVulnerability first disclosed.
  2. 01-06-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues when using bus-less or driver-less devices where the device might never get freed if a managed resource holds a reference to the device. This is happening in the DRM framework for example. We should thus call devres_release_all() in the device_del() function to make sure that the device-managed actions are properly executed when the device is unregistered, even if it has neither a bus nor a driver. This is effectively the same change than commit 2f8d16a996da ("devres: release resources on device_del()") that got reverted by commit a525a3ddeaca ("driver core: free devres in device_release") over memory leaks concerns. This patch effectively combines the two commits mentioned above to release the resources both on device_del() and device_release() and get the best of both worlds.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.15% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu124 products
  • linuxAll versions (No fix recorded) | < 5.15.0-186.196
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < 83e2ec36a92432e9445e853c12becbbae353b511 | ≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3 | ≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < 297992e5c63528e603666e36081836204fc36ec9 | ≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < 3bcc4c2a096e8342c8c719e595ce15de212694dd | ≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < c8c426fae26086a0ca8ab6cc6da2de79810ec038 | ≥ a525a3ddeaca69f405d98442ab3c0746e53168dc, < 699fb50d99039a50e7494de644f96c889279aca3 | 3.7
  • linux_kernel≥ 3.7, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.53 | ≥ 6.2, < 6.4.16 | ≥ 6.5, < 6.5.3
Debian1 product
  • linux< 6.1.55-1 | < 6.5.3-1

3 vendors · 127 products

References

22 links
Show all 22 references