CVE-2023-53003: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.

Affected products

Linux kernel: from 4.20 before 5.4.231; from 5.5 before 5.10.166; from 5.11 before 5.15.91; from 5.16 before 6.1.9; 6.2-rc1, 6.2-rc2, 6.2-rc3, 6.2-rc4, 6.2-rc5 — fixed in 5.10.166, 5.15.91, 5.4.231, 6.1.9

How to fix

Upgrade to a fixed version: Linux kernel 5.10.166, 5.15.91, 5.4.231, 6.1.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53003 or the next vulnerability affects your stack