{
  "cveId": "CVE-2023-52609",
  "url": "https://patchblox.com/security/cve/CVE-2023-52609",
  "summary": "CVE-2023-52609 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52609, released March 18, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  binder: fix race between mmput() and do_exit()...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  binder: fix race between mmput() and do_exit()  Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A.    Task A            | Task B   ------------------\u002B------------------   mmget_not_zero()  |                     |  do_exit()                     |    exit_mm()                     |      mmput()   mmput()           |     exit_mmap()     |       remove_vma()  |         fput()      |  In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it\u0027s dead).  This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.  In order to fix this use mmput_async() that will schedule the work in the corresponding mm-\u003Easync_put_work WQ instead of Task A.",
  "published": "2024-03-18T11:15:07Z",
  "severity": "medium",
  "cvss": 4.7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00185,
  "epssPercentile": 0.08181,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.76-1",
      "fix": "DEBIAN-CVE-2023-52609",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52609",
      "released": "2024-03-18T11:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.6.15-1",
      "fix": "DEBIAN-CVE-2023-52609",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52609",
      "released": "2024-03-18T11:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.6.15-1",
      "fix": "DEBIAN-CVE-2023-52609",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52609",
      "released": "2024-03-18T11:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}