CVE-2023-53446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-53446
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53446.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-53446
Downstream
Related
Published
2025-09-18T16:04:21.939Z
Modified
2026-05-28T03:55:17.631309058Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
Details

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

Struct pcielinkstate->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.:

# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy

BUG: KASAN: slab-use-after-free in pcieconfigaspmlink+0x42d/0x500 Call Trace: kasanreport+0xae/0xe0 pcieconfigaspmlink+0x42d/0x500 pcieaspmsetpolicy+0x8e/0x1a0 paramattrstore+0x162/0x2c0 moduleattrstore+0x3e/0x80

PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices.

Disable ASPM and free the pcielinkstate when any child function is removed so we can discard the dangling pcielinkstate->downstream pointer and maintain the same ASPM Control configuration for all functions.

[bhelgaas: commit log and comment]

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53446.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06
Fixed
666e7f9d60cee23077ea3e6331f6f8a19f7ea03f
Fixed
7badf4d6f49a358a01ab072bbff88d3ee886c33b
Fixed
9856c0de49052174ab474113f4ba40c02aaee086
Fixed
7aecdd47910c51707696e8b0e045b9f88bd4230f
Fixed
d51d2eeae4ce54d542909c4d9d07bf371a78592c
Fixed
4203722d51afe3d239e03f15cc73efdf023a7103
Fixed
456d8aa37d0f56fc9e985e812496e861dcd6f2f2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53446.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.11.0
Fixed
5.4.251
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.188
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.121
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.39
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.3.13
Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.4.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53446.json"