CVE-2023-53515

virtio-mmio: don't break lifecycle of vm_dev

published October 1, 2025

CVSS
—
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

virtio-mmio: don't break lifecycle of vm_dev

vm_dev has a separate lifecycle because it has a 'struct device'

embedded. Thus, having a release callback for it is correct.

Allocating the vm_dev struct with devres totally breaks this protection,

though. Instead of waiting for the vm_dev release callback, the memory

is freed when the platform_device is removed. Resulting in a

use-after-free when finally the callback is to be called.

To easily see the problem, compile the kernel with

CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.

The fix is easy, don't use devres in this case.

Found during my research about object lifetime problems.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00152 · 4.0th percentile
Published
2025-10-01T11:46Z
EPSS history
Timeline
  • 01 OCT 11:46Z
    virtio-mmio: don't break lifecycle of vm_dev
    cvelistv5