{
  "cveId": "CVE-2023-52468",
  "url": "https://patchblox.com/security/cve/CVE-2023-52468",
  "summary": "CVE-2023-52468 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52468, released February 26, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  class: fix use-after-free in class_register()  T...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  class: fix use-after-free in class_register()  The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister the lock_class_key before kfree(cp).  On our platform, a driver fails to kset_register because of creating duplicate filename \u0027/class/xxx\u0027.With Kasan enabled, it prints a invalid-access bug report.  KASAN bug report:  BUG: KASAN: invalid-access in lockdep_register_key\u002B0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe]  CPU: 7 PID: 252 Comm: modprobe Tainted: G        W  6.6.0-mainline-maybe-dirty #1  Call trace: dump_backtrace\u002B0x1b0/0x1e4 show_stack\u002B0x2c/0x40 dump_stack_lvl\u002B0xac/0xe0 print_report\u002B0x18c/0x4d8 kasan_report\u002B0xe8/0x148 __hwasan_store8_noabort\u002B0x88/0x98 lockdep_register_key\u002B0x19c/0x1bc class_register\u002B0x94/0x1ec init_module\u002B0xbc/0xf48 [rfkill] do_one_initcall\u002B0x17c/0x72c do_init_module\u002B0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe \u003Effffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe                                      ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03  As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access not use-after-free here.In this case, modprobe is manipulating the corrupted lock_keys_hash hlish where lock_class_key is already freed before.  It\u0027s worth noting that this only can happen if lockdep is enabled, which is not true for normal system.",
  "published": "2024-02-26T16:27:48Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00275,
  "epssPercentile": 0.19969,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.6.15-1",
      "fix": "DEBIAN-CVE-2023-52468",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52468",
      "released": "2024-02-26T16:27:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.6.15-1",
      "fix": "DEBIAN-CVE-2023-52468",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52468",
      "released": "2024-02-26T16:27:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}