GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53640 (GCVE-0-2023-53640)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:19 – Updated: 2026-08-05 09:15
VLAI
Title
ASoC: lpass: Fix for KASAN use_after_free out of bounds
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110 Read of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144 CPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G W Hardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT) Call trace: dump_backtrace+0x0/0x4ec show_stack+0x34/0x50 dump_stack_lvl+0xdc/0x11c print_address_description+0x30/0x2d8 kasan_report+0x178/0x1e4 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf8/0x5a0 _regmap_read+0x45c/0x86c _regmap_update_bits+0x128/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_put_dec_enum+0x1d0/0x268 snd_ctl_elem_write+0x288/0x474 By Error checking and checking valid values issue gets rectifies.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c39667ddcfc516fee084e449179d54430a558298 , < 8f1512d78b5de928f4616a871e77b58fd546e651 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 8d81d3b0ed3610d24191d24f8e9e20f6775f0cc5 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < f5e61e3fe799ba2fda4320af23d26d28c3302045 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.114 , ≤ 5.15.* (semver)
Unaffected: 6.1.31 , ≤ 6.1.* (semver)
Unaffected: 6.3.5 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-tx-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f1512d78b5de928f4616a871e77b58fd546e651",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "8d81d3b0ed3610d24191d24f8e9e20f6775f0cc5",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "f5e61e3fe799ba2fda4320af23d26d28c3302045",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-tx-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.114",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.31",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: lpass: Fix for KASAN use_after_free out of bounds\n\nWhen we run syzkaller we get below Out of Bounds error.\n\n\"KASAN: slab-out-of-bounds Read in regcache_flat_read\"\n\nBelow is the backtrace of the issue:\n\nBUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110\nRead of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144\nCPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G        W\nHardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT)\nCall trace:\ndump_backtrace+0x0/0x4ec\nshow_stack+0x34/0x50\ndump_stack_lvl+0xdc/0x11c\nprint_address_description+0x30/0x2d8\nkasan_report+0x178/0x1e4\n__asan_report_load4_noabort+0x44/0x50\nregcache_flat_read+0x10c/0x110\nregcache_read+0xf8/0x5a0\n_regmap_read+0x45c/0x86c\n_regmap_update_bits+0x128/0x290\nregmap_update_bits_base+0xc0/0x15c\nsnd_soc_component_update_bits+0xa8/0x22c\nsnd_soc_component_write_field+0x68/0xd4\ntx_macro_put_dec_enum+0x1d0/0x268\nsnd_ctl_elem_write+0x288/0x474\n\nBy Error checking and checking valid values issue gets rectifies."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through an SNDRV_CTL_IOCTL_ELEM_WRITE ioctl on the local ALSA control device /dev/snd/controlC*, targeting the \"TX SMIC MUXn\" DAPM mux control. There is no network-facing path to lpass-tx-macro.\nAC:L - A single ioctl with an attacker-chosen 32-bit enumerated value deterministically produces the out-of-bounds access; the attacker directly selects the offending register offset via val, with no race, timing, or memory-layout precondition.\nPR:L - The attacker needs only an unprivileged local account with access to the sound control device (granted by udev ACL/audio group on desktops, and demonstrated by syzkaller running as an ordinary user process on sc7280); snd_ctl_elem_write performs no capability check.\nUI:N - The attacker triggers the bug entirely from their own process with one ioctl; no victim action, no file open, and no device plug-in is required.\nS:U - The out-of-bounds access and the resulting corruption/crash are confined to the kernel\u0027s own memory and the codec device it manages, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - regcache_flat_read() performs an unchecked 4-byte read at an attacker-selected index up to 16383 into a 491-entry array, exposing up to ~63.5 KB of adjacent kernel heap, and the read value is observable as a repeatable oracle since the subsequent write (and its dev_err/return code) only occurs when the leaked word\u0027s masked bits differ from tx-\u003edmic_clk_div.\nI:L - The out-of-bounds cache write is blocked by regmap_writeable()\u0027s max_register check, but the u16 truncation of dmic_clk_reg lets the attacker force a 3-bit CDC_TX_SWR_DMIC_CLK_SEL field into any writable TX-macro register and its regcache entry, giving unintended but bounded modification of codec clocking, routing, and mute state.\nA:H - The 64 KB out-of-bounds read can land in an unmapped no-map carveout hole in the arm64 linear map (common on Qualcomm SoCs) causing an oops while card-\u003econtrols_rwsem is held for write, permanently deadlocking the ALSA control device, and it panics outright on KASAN/hardened builds; stray writes to TX-macro clock/reset registers can additionally wedge the audio hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:17.951Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f1512d78b5de928f4616a871e77b58fd546e651"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d81d3b0ed3610d24191d24f8e9e20f6775f0cc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5e61e3fe799ba2fda4320af23d26d28c3302045"
        },
        {
          "url": "https://git.kernel.org/stable/c/75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1"
        }
      ],
      "title": "ASoC: lpass: Fix for KASAN use_after_free out of bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53640",
    "datePublished": "2025-10-07T15:19:40.348Z",
    "dateReserved": "2025-10-07T15:16:59.658Z",
    "dateUpdated": "2026-08-05T09:15:17.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53640",
      "date": "2026-09-17",
      "epss": "0.00208",
      "percentile": "0.11206"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53640\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:47.270\",\"lastModified\":\"2026-08-04T10:19:15.920\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: lpass: Fix for KASAN use_after_free out of bounds\\n\\nWhen we run syzkaller we get below Out of Bounds error.\\n\\n\\\"KASAN: slab-out-of-bounds Read in regcache_flat_read\\\"\\n\\nBelow is the backtrace of the issue:\\n\\nBUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110\\nRead of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144\\nCPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G        W\\nHardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT)\\nCall trace:\\ndump_backtrace+0x0/0x4ec\\nshow_stack+0x34/0x50\\ndump_stack_lvl+0xdc/0x11c\\nprint_address_description+0x30/0x2d8\\nkasan_report+0x178/0x1e4\\n__asan_report_load4_noabort+0x44/0x50\\nregcache_flat_read+0x10c/0x110\\nregcache_read+0xf8/0x5a0\\n_regmap_read+0x45c/0x86c\\n_regmap_update_bits+0x128/0x290\\nregmap_update_bits_base+0xc0/0x15c\\nsnd_soc_component_update_bits+0xa8/0x22c\\nsnd_soc_component_write_field+0x68/0xd4\\ntx_macro_put_dec_enum+0x1d0/0x268\\nsnd_ctl_elem_write+0x288/0x474\\n\\nBy Error checking and checking valid values issue gets rectifies.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/codecs/lpass-tx-macro.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"8f1512d78b5de928f4616a871e77b58fd546e651\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"8d81d3b0ed3610d24191d24f8e9e20f6775f0cc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"f5e61e3fe799ba2fda4320af23d26d28c3302045\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/codecs/lpass-tx-macro.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.114\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.31\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.5\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.114\",\"matchCriteriaId\":\"68F8E179-8339-4608-9B4A-2B6B83F723DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.31\",\"matchCriteriaId\":\"79A1436B-7738-4A85-8FE6-B844059F22D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.5\",\"matchCriteriaId\":\"34DD94CA-4DA1-41C3-9A9B-92ACD7F4E240\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BC6744-7D25-4C02-9966-B224CD071D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"76061B41-CAE9-4467-BEDE-0FFC7956F2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A717BA5B-D535-46A0-A329-A25FE5CEC588\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/75e5fab7db0cecb6e16b22c34608f0b40a4c7cd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d81d3b0ed3610d24191d24f8e9e20f6775f0cc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f1512d78b5de928f4616a871e77b58fd546e651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5e61e3fe799ba2fda4320af23d26d28c3302045\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:17:14+00:00",
      "cve": "CVE-2023-53640",
      "id": "CVE-2023-53640",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "272",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: lpass: Fix for KASAN use_after_free out of bounds",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53640.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T02:06:00Z",
      "cve": "CVE-2023-53640",
      "id": "CVE-2023-53640",
      "initial_release_date": "2025-10-08T23:30:53Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "395",
      "product_status:recommended": "225",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53640",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53640.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.