CVE-2023-53613

dax: Fix dax_mapping_release() use after free

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000) [..] DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260 [..] RIP: 0010:__lock_acquire+0x9fc/0x2260 [..] Call Trace: <TASK> [..] lock_acquire+0xd4/0x2c0 ? ida_free+0x62/0x130 _raw_spin_lock_irqsave+0x47/0x70 ? ida_free+0x62/0x130 ida_free+0x62/0x130 dax_mapping_release+0x1f/0x30 device_release+0x36/0x90 kobject_delayed_cleanup+0x46/0x150

Due to attempting ida_free() on an ida object that has already been freed. Devices typically only hold a reference on their parent while registered. If a child needs a parent object to complete its release it needs to hold a reference that it drops from its release callback. Arrange for a dax_mapping to pin its parent dev_dax instance until dax_mapping_release().

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.15%Up 0.1 points since Oct 5, 2025

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

Record: CVE-2023-53613
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

dax: Fix dax_mapping_release() use after free

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

Record: CVE-2023-53613
Updated: 2026-11-02

EUVDEUVD-2025-32281 No score

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

Record: EUVD-2025-32281
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6789-c3xj-p7cq 7.8

In the Linux kernel, the following vulnerability has been resolved: dax: Fix dax_mapping_release...

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

Record: GHSA-6789-c3xj-p7cq
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2023-53613 7.8

Record: BELL-CVE-2023-53613
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-53613 7.8

In the Linux kernel, the following vulnerability has been resolved: dax: Fix dax_mapping_release() use after free A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields: kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000) [..] DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260 [..] RIP: 0010:__lock_acquire+0x9fc/0x2260 [..] Call Trace: <TASK> [..] lock_acquire+0xd4/0x2c0 ? ida_free+0x62/0x130 _raw_spin_lock_irqsave+0x47/0x70 ? ida_free+0x62/0x130 ida_free+0x62/0x130 dax_mapping_release+0x1f/0x30 device_release+0x36/0x90 kobject_delayed_cleanup+0x46/0x150 Due to attempting ida_free() on an ida object that has already been freed. Devices typically only hold a reference on their parent while registered. If a child needs a parent object to complete its release it needs to hold a reference that it drops from its release callback. Arrange for a dax_mapping to pin its parent dev_dax instance until dax_mapping_release().

Record: DEBIAN-CVE-2023-53613
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 14 moreShow less

OSVRHSA-2024:9315 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:9315
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-53613 7.8

Record: UBUNTU-CVE-2023-53613
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVCLSA-2026-1779987841 No score

kernel: Fix of 110 CVEs

smb: client: reject userspace cifs.spnego descriptions
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
driver core: fix resource leak in device_add() {CVE-2023-53594}
wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
cpufreq: exit() callback is optional {CVE-2024-38615}
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
usb: ulpi: fix memory leak on ulpi_register() error paths
usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
bnxt: Do not read past the end of test names {CVE-2023-53010}
dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
cifs: Fix oops due to uncleared server->smbd_conn…

Record: CLSA-2026-1779987841
Updated: 2026-11-02

OSV No score

dax: Fix dax_mapping_release() use after free

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free

A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields:

Record: CVE-2023-53613
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1 No score