# CVE-2023-53138: linux: In the Linux kernel, the following vulnerability has been resolved:  net: caif: Fix use-after-free in cfusbl_device_n...

CVE-2023-53138 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53138, released May 2, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-53138
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 2, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: caif: Fix use-after-free in cfusbl_device_notify()  syzbot reported use-after-free in cfusbl_device_notify() [1].  This causes a stack trace like below:  BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214  CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace:  <TASK>  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106  print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313  print_report mm/kasan/report.c:429 [inline]  kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491  cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138  notifier_call_chain+0xb5/0x200 kernel/notifier.c:87  call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945  call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]  call_netdevice_notifiers net/core/dev.c:1997 [inline]  netdev_wait_allrefs_any net/core/dev.c:10227 [inline]  netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341  default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334  ops_exit_list+0x125/0x170 net/core/net_namespace.c:167  cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594  process_one_work+0x996/0x1610 kernel/workqueue.c:2289  worker_thread+0x665/0x1080 kernel/workqueue.c:2436  kthread+0x2e9/0x3a0 kernel/kthread.c:376  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302  </TASK>  When unregistering a net device, unregister_netdevice_many_notify() sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers with NETDEV_UNREGISTER, and adds the device to the todo list.  Later on, devices in the todo list are processed by netdev_run_todo(). netdev_run_todo() waits devices' reference count become 1 while rebdoadcasting NETDEV_UNREGISTER notification.  When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple times, the parent device might be freed.  This could cause UAF. Processing NETDEV_UNREGISTER multiple times also causes inbalance of reference count for the module.  This patch fixes the issue by accepting only first NETDEV_UNREGISTER notification.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.20-1 | [DEBIAN-CVE-2023-53138](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53138.md) | May 2, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.1.20-1 | [DEBIAN-CVE-2023-53138](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53138.md) | May 2, 2025 |
| Linux | linux Debian 14 | 6.1.20-1 | [DEBIAN-CVE-2023-53138](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53138.md) | May 2, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.