VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 29, 2024· Updated Jan 5, 2026

Input: powermate - fix use-after-free in powermate_config_complete

CVE-2023-52475

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

198

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.