Low · 3.8 CVE-2023-52584 EUVD-2023-57208GHSA-jmmm-pcpp-rrc4

spmi: mediatek: Fix UAF on device remove

Published Mar 6, 2024 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

spmi: mediatek: Fix UAF on device remove

The pmif driver data that contains the clocks is allocated along with
spmi_controller.
On device remove, spmi_controller will be freed first, and then devres
, including the clocks, will be cleanup.
This leads to UAF because putting the clocks will access the clocks in
the pmif driver data, which is already freed along with spmi_controller.

This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and
building the kernel with KASAN.

Fix the UAF issue by using unmanaged clk_bulk_get() and putting the
clocks before freeing spmi_controller.

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	5.17	6.1.77

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	6.7.7-1	—
Debian 13	linux	6.7.7-1	—
Debian 12	linux	6.1.82-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	linux-azure-6.5	6.5.0-1022.23~22.04.1	USN-6819-1
Ubuntu 22.04 LTS	linux-gcp-6.5	6.5.0-1022.24~22.04.1	USN-6818-1
Ubuntu 22.04 LTS	linux-hwe-6.5	6.5.0-41.41~22.04.2	USN-6818-4
Ubuntu 22.04 LTS	linux-lowlatency-hwe-6.5	6.5.0-41.41.1~22.04.1	USN-6818-1
Ubuntu 22.04 LTS	linux-nvidia-6.5	6.5.0-1021.22	USN-6818-3
Ubuntu 22.04 LTS	linux-oem-6.1	6.1.0-1035.35	USN-6688-1
Ubuntu 22.04 LTS	linux-oem-6.5	6.5.0-1024.25	USN-6819-3
Ubuntu 22.04 LTS	linux-oracle-6.5	6.5.0-1024.24~22.04.1	USN-6819-4
Ubuntu 22.04 LTS	linux-riscv +22	No fix yet	—
Ubuntu 22.04 LTS	linux-riscv-6.5	6.5.0-40.40.1~22.04.1	—
Ubuntu 22.04 LTS	linux-starfive-6.5	6.5.0-1015.16~22.04.1	USN-6819-1
Ubuntu 20.04 LTS	linux-gke +26	No fix yet	—
Ubuntu 18.04 LTS	linux-gcp +13	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro Realtime 24.04 LTS	linux-raspi-realtime	6.8.0-2001.1	—

Advisories 9

USN-6819-4 linux-oracle-6.5 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6818-3 linux-nvidia-6.5 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6819-3 linux-oem-6.5 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6818-1 linux, linux-gcp, linux-gcp-6.5, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6818-4 linux-hwe-6.5 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6819-1 linux-azure, linux-azure-6.5, linux-starfive, linux-starfive-6.5 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
USN-6688-1 linux-oem-6.1 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
WID-SEC-2024-0561 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 15, 2026
WID-SEC-2025-0612 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 20, 2025

References