CVE-2023-53640CWE-416

CVE-2023-53640

High · published October 7, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: lpass: Fix for KASAN use_after_free out of bounds

When we run syzkaller we get below Out of Bounds error.

"KASAN: slab-out-of-bounds Read in regcache_flat_read"

Below is the backtrace of the issue:

BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110

Read of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144

CPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G W

Hardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT)

Call trace:

dump_backtrace+0x0/0x4ec

show_stack+0x34/0x50

dump_stack_lvl+0xdc/0x11c

print_address_description+0x30/0x2d8

kasan_report+0x178/0x1e4

__asan_report_load4_noabort+0x44/0x50

regcache_flat_read+0x10c/0x110

regcache_read+0xf8/0x5a0

_regmap_read+0x45c/0x86c

_regmap_update_bits+0x128/0x290

regmap_update_bits_base+0xc0/0x15c

snd_soc_component_update_bits+0xa8/0x22c

snd_soc_component_write_field+0x68/0xd4

tx_macro_put_dec_enum+0x1d0/0x268

snd_ctl_elem_write+0x288/0x474

By Error checking and checking valid values issue gets rectifies.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-07T20:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 5.12, < 5.15.1145.15.114
linux/linux_kernel≥ 5.16, < 6.1.316.1.31
linux/linux_kernel≥ 6.2, < 6.3.56.3.5
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 07 OCT 15:19Z
    ASoC: lpass: Fix for KASAN use_after_free out of bounds
    cvelistv5