VYPR
Unrated severityNVD Advisory· Published Oct 7, 2025

clk: microchip: fix potential UAF in auxdev release callback

CVE-2023-53636

Description

In the Linux kernel, the following vulnerability has been resolved:

clk: microchip: fix potential UAF in auxdev release callback

Similar to commit 1c11289b34ab ("peci: cpu: Fix use-after-free in adev_release()"), the auxiliary device is not torn down in the correct order. If auxiliary_device_add() fails, the release callback will be called twice, resulting in a UAF. Due to timing, the auxdev code in this driver "took inspiration" from the aforementioned commit, and thus its bugs too!

Moving auxiliary_device_uninit() to the unregister callback instead avoids the issue.

Affected products

1
  • Linux/Linuxv5
    Range: 6.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.