Linux Kernel up to 6.1.10 nvmem dev_set_name cleanup

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 6.1.10. This vulnerability affects the function dev_set_name of the component nvmem. Performing a manipulation results in an unknown weakness. This vulnerability is known as CVE-2023-52929. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.1.10. This affects the function dev_set_name of the component nvmem. CWE is classifying the issue as CWE-459. The product does not properly "clean up" and remove temporary or supporting resources after they have been used. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix cleanup after dev_set_name() If dev_set_name() fails, we leak nvmem->wp_gpio as the cleanup does not put this. While a minimal fix for this would be to add the gpiod_put() call, we can do better if we split device_register(), and use the tested nvmem_release() cleanup code by initialising the device early, and putting the device. This results in a slightly larger fix, but results in clear code. Note: this patch depends on "nvmem: core: initialise nvmem->id early" and "nvmem: core: remove nvmem_config wp_gpio". [Srini: Fixed subject line and error code handing with wp_gpio while applying.]

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2023-52929 since 08/21/2024. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.1.11 eliminates this vulnerability. Applying the patch 23676ecd2eb377f7c24a6ff578b0f4c7135658b6/8f9c4b2a3b132bf6698e477aba6ee194b40c75f4/39708bc8da7858de0bed9b3a88b3beb1d1e0b443/560181d3ace61825f4ca9dd3481d6c0ee6709fa8 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-0649). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Dell Avamar
• Open Source Linux Kernel
• SolarWinds Security Event Manager
• Dell NetWorker
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion