# CVE-2023-52617: linux: In the Linux kernel, the following vulnerability has been resolved:  PCI: switchtec: Fix stdev_release() crash after...

CVE-2023-52617 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52617, released March 18, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2023-52617
- Priority: Routine
- CVSS: 4.4 (medium)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 18, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  PCI: switchtec: Fix stdev_release() crash after surprise hot remove  A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return.  At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer.  Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents.  Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.82-1 | [DEBIAN-CVE-2023-52617](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52617.md) | Mar 18, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.7.7-1 | [DEBIAN-CVE-2023-52617](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52617.md) | Mar 18, 2024 |
| Linux | linux Debian 14 | 6.7.7-1 | [DEBIAN-CVE-2023-52617](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52617.md) | Mar 18, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.