{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53674","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-07T15:16:59.663Z","datePublished":"2025-10-07T15:21:30.320Z","dateUpdated":"2026-08-05T09:15:27.585Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:15:27.585Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix memory leak in devm_clk_notifier_register()\n\ndevm_clk_notifier_register() allocates a devres resource for clk\nnotifier but didn't register that to the device, so the notifier didn't\nget unregistered on device detach and the allocated resource was leaked.\n\nFix the issue by registering the resource through devres_add().\n\nThis issue was found with kmemleak on a Chromebook."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The clk core is reached only through local interfaces — driver bind/unbind, device probe, and clock rate changes driven by local syscalls (DRM/KMS, ALSA, devfreq, IIO sysfs). There is no path from a remote peer or network packet into `devm_clk_notifier_register()` or `__clk_notify()`.\nAC:L - No race or improbable memory layout is required: once the notifier is left registered, `notifier_count` stays permanently incremented so `__clk_notify()` is guaranteed to walk the stale list entry and dereference the freed `struct clk` on the next rate change, which a local attacker can induce reliably via ordinary GPU/audio/cpufreq activity.\nPR:L - The dangling notifier arises without any attacker privilege — a probe failure after `devm_clk_notifier_register()` (e.g. `adf4377_probe()`, tegra `pmc`, xlnx clock wizard) leaves it registered at boot — and an ordinary unprivileged user then reaches the use-after-free by causing any clock rate change and by spraying the freed devm allocation.\nUI:N - No victim action is needed; the stale notifier is left behind automatically on detach or probe failure, and the UAF fires from background clock rate changes with no interaction.\nS:U - The freed memory, the notifier chain, and the resulting corruption are all within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `__clk_notify()` reads through the freed `cn->clk` pointer on every rate change, and control of the reallocated object plus the callback's dereference of `mux_nb->ops` yields an arbitrary-read primitive over kernel memory.\nI:H - The stale `notifier_block` is invoked through `srcu_notifier_call_chain()` after its containing devm allocation is freed, so heap spraying gives the attacker a controlled indirect call (`mux_nb->ops->get_parent`) and hence control-flow hijack and arbitrary write.\nA:H - Beyond the unbounded devres/`clk_notifier` leak, the use-after-free dereference of the freed `struct clk` and the call through freed function pointers reliably oopses or panics the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/clk.c"],"versions":[{"version":"6d30d50d037dfa092f9d5d1fffa348ab4abb7163","lessThan":"a326cf0107b197e649bbaa2a2b1355894826ce32","status":"affected","versionType":"git"},{"version":"6d30d50d037dfa092f9d5d1fffa348ab4abb7163","lessThan":"49451db71b746df990888068961f1033f7c9b734","status":"affected","versionType":"git"},{"version":"6d30d50d037dfa092f9d5d1fffa348ab4abb7163","lessThan":"cb1b04fd4283fc8f9acefe0ddc61ba072ed44877","status":"affected","versionType":"git"},{"version":"6d30d50d037dfa092f9d5d1fffa348ab4abb7163","lessThan":"efbbda79b2881a04dcd0e8f28634933d79e17e49","status":"affected","versionType":"git"},{"version":"6d30d50d037dfa092f9d5d1fffa348ab4abb7163","lessThan":"7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/clk.c"],"versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","status":"unaffected","versionType":"semver"},{"version":"5.15.121","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.39","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.3.13","lessThanOrEqual":"6.3.*","status":"unaffected","versionType":"semver"},{"version":"6.4.4","lessThanOrEqual":"6.4.*","status":"unaffected","versionType":"semver"},{"version":"6.5","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.3.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.4.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32"},{"url":"https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734"},{"url":"https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877"},{"url":"https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49"},{"url":"https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff"}],"title":"clk: Fix memory leak in devm_clk_notifier_register()","x_generator":{"engine":"bippy-1.2.0"}}}}