CVE-2023-53596

drivers: base: Free devm resources when unregistering a device

published October 4, 2025

CVSS
—
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drivers: base: Free devm resources when unregistering a device

In the current code, devres_release_all() only gets called if the device

has a bus and has been probed.

This leads to issues when using bus-less or driver-less devices where

the device might never get freed if a managed resource holds a reference

to the device. This is happening in the DRM framework for example.

We should thus call devres_release_all() in the device_del() function to

make sure that the device-managed actions are properly executed when the

device is unregistered, even if it has neither a bus nor a driver.

This is effectively the same change than commit 2f8d16a996da ("devres:

release resources on device_del()") that got reverted by commit

a525a3ddeaca ("driver core: free devres in device_release") over

memory leaks concerns.

This patch effectively combines the two commits mentioned above to

release the resources both on device_del() and device_release() and get

the best of both worlds.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Published
2025-10-04T15:44Z
EPSS history
Timeline
  • 04 OCT 15:44Z
    drivers: base: Free devm resources when unregistering a device
    cvelistv5