Cloudanix VulnDB

CVE-2023-53484

None

CVSS

—

EPSS

0.2%

Published

Oct 1, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel could let attackers crash systems or gain elevated access if certain low-level hardware notification code runs in a specific order.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in lib/cpu_rmap where irq_set_affinity_notifier(irq, NULL) frees the rmap->obj array entry without clearing the pointer, allowing a subsequent free_irq_cpu_rmap() call to free the same entry again.

Why it matters to the business

On Linux systems, this can lead to kernel instability, crashes, or potential privilege escalation if the vulnerable code path is exercised, affecting server and device uptime and security.

How an attack unfolds

An attacker with the ability to manipulate IRQ affinity notifiers and trigger rmap cleanup would call irq_set_affinity_notifier with a NULL notify argument to leave a dangling pointer, then invoke free_irq_cpu_rmap to trigger the double-free; while not currently reachable in mainline kernels, the flaw enables exploitation once additional code paths are present.

How to fix it

Update the Linux kernel to the fixed commit 981f339d2905b6a92ef59358158b326493aecac5 or later stable releases that include the patch; rebuild and deploy updated kernels across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 981f339d2905b6a92ef59358158b326493aecac5; inspect cpu_rmap.c for the added NULL assignment and non-zero check before freeing array entries.

Typical attack path

  1. Obtain sufficient privileges to manage IRQ affinity notifiers
  2. Invoke irq_set_affinity_notifier with NULL notify argument to free without clearing the array entry
  3. Trigger free_irq_cpu_rmap to attempt double-free of the dangling pointer
  4. Leverage the resulting use-after-free for memory corruption or control-flow hijacking

How to detect it

Examine kernel logs for double-free warnings or slab corruption messages referencing cpu_rmap or irq affinity structures; audit source for any new callers of irq_set_affinity_notifier with NULL notify.

What your security team should do

  • Prioritize kernel updates on all production Linux hosts within the next maintenance window
  • Monitor upstream stable kernel releases for backports of the fix
  • Review any custom drivers or patches that call irq_set_affinity_notifier or free_irq_cpu_rmap for similar patterns

The record

In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap(). The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 4.14.316
Linux Kernel 3.8.0 4.14.316

Related vulnerabilities