Linux Kernel up to 5.15.120/6.1.38/6.3.12/6.4.3 64s use after free

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel up to 5.15.120/6.1.38/6.3.12/6.4.3. This affects an unknown part of the component 64s. This manipulation causes use after free. This vulnerability appears as CVE-2023-54042. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.15.120/6.1.38/6.3.12/6.4.3. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component 64s. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2023-54042 since 12/24/2025. The exploitation appears to be easy. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/26/2025).

The vulnerability scanner Nessus provides a plugin with the ID 279946 (Linux Distros Unpatched Vulnerability : CVE-2023-54042), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.121, 6.1.39, 6.3.13 or 6.4.4 eliminates this vulnerability. Applying the patch f7d92313002b2d543500cc417d8079aaed1fb0a8/4e82f92c349ea603736ade1e814861c0182a55ad/db8657fdd53c5e3069149d7f957cb60e63027bb2/421cd1544480f2458042fe7f4913a2069c4d7251/b4bda59b47879cce38a6ec5a01cd3cac702b5331 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (279946) and CERT Bund (WID-SEC-2025-2920). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.120
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.1.23
• 6.1.24
• 6.1.25
• 6.1.26
• 6.1.27
• 6.1.28
• 6.1.29
• 6.1.30
• 6.1.31
• 6.1.32
• 6.1.33
• 6.1.34
• 6.1.35
• 6.1.36
• 6.1.37
• 6.1.38
• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 6.3.6
• 6.3.7
• 6.3.8
• 6.3.9
• 6.3.10
• 6.3.11
• 6.3.12
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion