{"api_version":"1","generated_at":"2026-07-24T21:04:14+00:00","cve":"CVE-2023-53596","urls":{"html":"https://cve.report/CVE-2023-53596","api":"https://cve.report/api/cve/CVE-2023-53596.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-53596","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-53596"},"summary":{"title":"drivers: base: Free devm resources when unregistering a device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-10-04 16:15:56","updated_at":"2026-06-18 14:30:05"},"problem_types":["CWE-415"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3","name":"https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511","name":"https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd","name":"https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9","name":"https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038","name":"https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3","name":"https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53596","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53596","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc 83e2ec36a92432e9445e853c12becbbae353b511 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc 297992e5c63528e603666e36081836204fc36ec9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc 3bcc4c2a096e8342c8c719e595ce15de212694dd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc c8c426fae26086a0ca8ab6cc6da2de79810ec038 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a525a3ddeaca69f405d98442ab3c0746e53168dc 699fb50d99039a50e7494de644f96c889279aca3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.258 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.209 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.53 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4.16 6.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5.3 6.5.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"53596","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/base/core.c","drivers/base/test/platform-device-test.c","drivers/base/test/root-device-test.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83e2ec36a92432e9445e853c12becbbae353b511","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"},{"lessThan":"b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"},{"lessThan":"297992e5c63528e603666e36081836204fc36ec9","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"},{"lessThan":"3bcc4c2a096e8342c8c719e595ce15de212694dd","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"},{"lessThan":"c8c426fae26086a0ca8ab6cc6da2de79810ec038","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"},{"lessThan":"699fb50d99039a50e7494de644f96c889279aca3","status":"affected","version":"a525a3ddeaca69f405d98442ab3c0746e53168dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/base/core.c","drivers/base/test/platform-device-test.c","drivers/base/test/root-device-test.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.7"},{"lessThan":"3.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.53","versionType":"semver"},{"lessThanOrEqual":"6.4.*","status":"unaffected","version":"6.4.16","versionType":"semver"},{"lessThanOrEqual":"6.5.*","status":"unaffected","version":"6.5.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.6","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.258","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.209","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.53","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.16","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.5.3","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6","versionStartIncluding":"3.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds."}],"providerMetadata":{"dateUpdated":"2026-06-01T16:04:17.609Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/83e2ec36a92432e9445e853c12becbbae353b511"},{"url":"https://git.kernel.org/stable/c/b9ef4b0aa91d2f9f5951faafdbbd47cf01799ec3"},{"url":"https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9"},{"url":"https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd"},{"url":"https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038"},{"url":"https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3"}],"title":"drivers: base: Free devm resources when unregistering a device","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-53596","datePublished":"2025-10-04T15:44:08.942Z","dateReserved":"2025-10-04T15:40:38.478Z","dateUpdated":"2026-06-01T16:04:17.609Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-04 16:15:56","lastModifiedDate":"2026-06-18 14:30:05","problem_types":["CWE-415"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.10.258","matchCriteriaId":"E5E8C954-76D2-41E6-8C01-1844EC5AA2BD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.209","matchCriteriaId":"919C10A9-7951-4A74-BADD-C135A0A8D8B4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.53","matchCriteriaId":"B20754AF-3B8C-4574-A70D-EC24933810E5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.4.16","matchCriteriaId":"C3039EA3-F6CA-43EF-9F17-81A7EC6841EF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.5.3","matchCriteriaId":"880C803A-BEAE-4DA0-8A59-AC023F7B4EE3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"53596","Ordinal":"1","Title":"drivers: base: Free devm resources when unregistering a device","CVE":"CVE-2023-53596","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"53596","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds.","Type":"Description","Title":"drivers: base: Free devm resources when unregistering a device"}]}}}