CVE-2023-53479 in Linux
Summary
by MITRE • 10/01/2025
In the Linux kernel, the following vulnerability has been resolved:
cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()
KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following error:
BUG: KASAN: slab-use-after-free in cxl_parse_cfmws (drivers/cxl/acpi.c:299)
This happens in cxl_parse_cfmws(), where put_device() is called, releasing cxld, which is accessed later.
Use the local variables in the dev_err() instead of pointing to the released memory. Since the dev_err() is printing a resource, change the open coded print format to use the %pr format specifier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/21/2026
The vulnerability CVE-2023-53479 represents a critical use-after-free condition within the Linux kernel's Compute Express Link (CXL) driver subsystem, specifically affecting the acpi.c component. This flaw manifests during the cxl_decoder_add() function's error handling path, where improper memory management leads to a situation where a device structure is freed but subsequently accessed, creating a potential security risk. The issue was identified through kernel memory debugging mechanisms including KASAN (Kernel Address Sanitizer) and KFENCE, which detected the problematic slab-use-after-free condition in the cxl_parse_cfmws() function at line 299 of the drivers/cxl/acpi.c source file.
The technical implementation of this vulnerability stems from improper resource management within the CXL driver's ACPI parsing logic. During error conditions in cxl_decoder_add(), the function calls put_device() which releases the cxld device structure, but subsequent code paths continue to reference this now-freed memory location. The kernel's memory management system detects this access violation and reports it as a use-after-free error, where the cxl_parse_cfmws() function attempts to access memory that has already been deallocated. This pattern violates fundamental memory safety principles and creates potential attack vectors for privilege escalation or system instability.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a potential pathway for attackers to exploit kernel memory management flaws. The use-after-free condition could enable malicious actors to manipulate kernel memory structures, potentially leading to privilege escalation attacks or denial of service conditions that compromise the entire system's integrity. According to CWE-416, this vulnerability maps directly to use-after-free conditions that occur when memory is accessed after it has been freed, a pattern commonly exploited in kernel-level attacks. The vulnerability also aligns with ATT&CK technique T1068, which covers 'Exploitation for Privilege Escalation' through kernel exploits that manipulate memory management subsystems.
Mitigation strategies for CVE-2023-53479 require immediate patch application from kernel vendors, as the fix involves modifying the error handling code to prevent reference to freed memory structures. The solution implemented addresses the root cause by ensuring that local variables are used in dev_err() calls instead of pointers to potentially freed memory, while also standardizing the print formatting to use the %pr format specifier for resource information. System administrators should prioritize updating to kernel versions containing this fix, particularly in environments running CXL-enabled hardware where the driver is actively utilized. Organizations should also implement monitoring for kernel memory errors and consider additional security measures such as kernel hardening configurations and runtime memory protection mechanisms to reduce the attack surface of similar vulnerabilities.