CVE-2023-53674 (GCVE-0-2023-53674)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:21 – Updated: 2026-08-05 09:15
VLAI
Title
clk: Fix memory leak in devm_clk_notifier_register()
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register() allocates a devres resource for clk notifier but didn't register that to the device, so the notifier didn't get unregistered on device detach and the allocated resource was leaked. Fix the issue by registering the resource through devres_add(). This issue was found with kmemleak on a Chromebook.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163 , < a326cf0107b197e649bbaa2a2b1355894826ce32 (git)
Affected: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163 , < 49451db71b746df990888068961f1033f7c9b734 (git)
Affected: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163 , < cb1b04fd4283fc8f9acefe0ddc61ba072ed44877 (git)
Affected: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163 , < efbbda79b2881a04dcd0e8f28634933d79e17e49 (git)
Affected: 6d30d50d037dfa092f9d5d1fffa348ab4abb7163 , < 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.121 , ≤ 5.15.* (semver)
Unaffected: 6.1.39 , ≤ 6.1.* (semver)
Unaffected: 6.3.13 , ≤ 6.3.* (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a326cf0107b197e649bbaa2a2b1355894826ce32",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "49451db71b746df990888068961f1033f7c9b734",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "cb1b04fd4283fc8f9acefe0ddc61ba072ed44877",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "efbbda79b2881a04dcd0e8f28634933d79e17e49",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            },
            {
              "lessThan": "7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff",
              "status": "affected",
              "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.39",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix memory leak in devm_clk_notifier_register()\n\ndevm_clk_notifier_register() allocates a devres resource for clk\nnotifier but didn\u0027t register that to the device, so the notifier didn\u0027t\nget unregistered on device detach and the allocated resource was leaked.\n\nFix the issue by registering the resource through devres_add().\n\nThis issue was found with kmemleak on a Chromebook."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The clk core is reached only through local interfaces \u2014 driver bind/unbind, device probe, and clock rate changes driven by local syscalls (DRM/KMS, ALSA, devfreq, IIO sysfs). There is no path from a remote peer or network packet into `devm_clk_notifier_register()` or `__clk_notify()`.\nAC:L - No race or improbable memory layout is required: once the notifier is left registered, `notifier_count` stays permanently incremented so `__clk_notify()` is guaranteed to walk the stale list entry and dereference the freed `struct clk` on the next rate change, which a local attacker can induce reliably via ordinary GPU/audio/cpufreq activity.\nPR:L - The dangling notifier arises without any attacker privilege \u2014 a probe failure after `devm_clk_notifier_register()` (e.g. `adf4377_probe()`, tegra `pmc`, xlnx clock wizard) leaves it registered at boot \u2014 and an ordinary unprivileged user then reaches the use-after-free by causing any clock rate change and by spraying the freed devm allocation.\nUI:N - No victim action is needed; the stale notifier is left behind automatically on detach or probe failure, and the UAF fires from background clock rate changes with no interaction.\nS:U - The freed memory, the notifier chain, and the resulting corruption are all within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `__clk_notify()` reads through the freed `cn-\u003eclk` pointer on every rate change, and control of the reallocated object plus the callback\u0027s dereference of `mux_nb-\u003eops` yields an arbitrary-read primitive over kernel memory.\nI:H - The stale `notifier_block` is invoked through `srcu_notifier_call_chain()` after its containing devm allocation is freed, so heap spraying gives the attacker a controlled indirect call (`mux_nb-\u003eops-\u003eget_parent`) and hence control-flow hijack and arbitrary write.\nA:H - Beyond the unbounded devres/`clk_notifier` leak, the use-after-free dereference of the freed `struct clk` and the call through freed function pointers reliably oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:27.585Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32"
        },
        {
          "url": "https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877"
        },
        {
          "url": "https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff"
        }
      ],
      "title": "clk: Fix memory leak in devm_clk_notifier_register()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53674",
    "datePublished": "2025-10-07T15:21:30.320Z",
    "dateReserved": "2025-10-07T15:16:59.663Z",
    "dateUpdated": "2026-08-05T09:15:27.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53674",
      "date": "2026-08-09",
      "epss": "0.00142",
      "percentile": "0.03984"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53674\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:51.370\",\"lastModified\":\"2026-08-04T10:19:17.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: Fix memory leak in devm_clk_notifier_register()\\n\\ndevm_clk_notifier_register() allocates a devres resource for clk\\nnotifier but didn\u0027t register that to the device, so the notifier didn\u0027t\\nget unregistered on device detach and the allocated resource was leaked.\\n\\nFix the issue by registering the resource through devres_add().\\n\\nThis issue was found with kmemleak on a Chromebook.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/clk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6d30d50d037dfa092f9d5d1fffa348ab4abb7163\",\"lessThan\":\"a326cf0107b197e649bbaa2a2b1355894826ce32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d30d50d037dfa092f9d5d1fffa348ab4abb7163\",\"lessThan\":\"49451db71b746df990888068961f1033f7c9b734\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d30d50d037dfa092f9d5d1fffa348ab4abb7163\",\"lessThan\":\"cb1b04fd4283fc8f9acefe0ddc61ba072ed44877\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d30d50d037dfa092f9d5d1fffa348ab4abb7163\",\"lessThan\":\"efbbda79b2881a04dcd0e8f28634933d79e17e49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d30d50d037dfa092f9d5d1fffa348ab4abb7163\",\"lessThan\":\"7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/clk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.39\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.13\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.121\",\"matchCriteriaId\":\"EC77775B-EC31-4966-966C-1286C02B2A85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.39\",\"matchCriteriaId\":\"9BD1D4A1-304D-4187-8178-6D7C0050B1AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.13\",\"matchCriteriaId\":\"95CB4836-7F5D-4C20-B025-8E046EC87B78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"6AB81046-CB69-4115-924C-963B37C41385\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:18:58+00:00",
      "cve": "CVE-2023-53674",
      "id": "CVE-2023-53674",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "174",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clk: Fix memory leak in devm_clk_notifier_register()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53674.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-23T02:14:05Z",
      "cve": "CVE-2023-53674",
      "id": "CVE-2023-53674",
      "initial_release_date": "2025-10-08T23:30:09Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "159",
      "product_status:recommended": "542",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53674",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53674.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.