CVE-2023-52617: PCI: switchtec: Fix stdev_release() crash after surprise hot remove

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-18 · updated 2026-06-17
Weakness: CWE-459

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return. At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer. Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents. Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

Affected products

Debian Linux: 10.0
Linux kernel: before 5.4.269; from 5.5 before 5.10.210; from 5.11 before 5.15.149; from 5.16 before 6.1.77; from 6.2 before 6.6.16; from 6.7 before 6.7.4 — fixed in 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4

How to fix

Upgrade to a fixed version: Linux kernel 5.10.210, 5.15.149, 5.4.269, 6.1.77. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52617 or the next vulnerability affects your stack