CVE-2023-53219

media: netup_unidvb: fix use-after-free at del_timer()

High · published September 15, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: netup_unidvb: fix use-after-free at del_timer()

When Universal DVB card is detaching, netup_unidvb_dma_fini()

uses del_timer() to stop dma->timeout timer. But when timer

handler netup_unidvb_dma_timeout() is running, del_timer()

could not stop it. As a result, the use-after-free bug could

happen. The process is shown below:

(cleanup routine) | (timer routine)

| mod_timer(&dev->tx_sim_timer, ..)

netup_unidvb_finidev() | (wait a time)

netup_unidvb_dma_fini() | netup_unidvb_dma_timeout()

del_timer(&dma->timeout); |

| ndev->pci_dev->dev //USE

Fix by changing del_timer() to del_timer_sync().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.3th percentile
Published
2025-09-15T14:21Z
EPSS history
Timeline
  • 15 SEP 14:21Z
    media: netup_unidvb: fix use-after-free at del_timer()
    cvelistv5