CVE-2023-53446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-53446
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53446.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-53446
Downstream
Related
Published
2025-09-18T16:04:21.939Z
Modified
2026-03-20T12:33:09.813650Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
Details

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

Struct pcielinkstate->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.:

# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy

BUG: KASAN: slab-use-after-free in pcieconfigaspmlink+0x42d/0x500 Call Trace: kasanreport+0xae/0xe0 pcieconfigaspmlink+0x42d/0x500 pcieaspmsetpolicy+0x8e/0x1a0 paramattrstore+0x162/0x2c0 moduleattrstore+0x3e/0x80

PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices.

Disable ASPM and free the pcielinkstate when any child function is removed so we can discard the dangling pcielinkstate->downstream pointer and maintain the same ASPM Control configuration for all functions.

[bhelgaas: commit log and comment]

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53446.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b5a0a9b59c8185aebcd9a717e2e6258b58c72c06
Fixed
666e7f9d60cee23077ea3e6331f6f8a19f7ea03f
Fixed
7badf4d6f49a358a01ab072bbff88d3ee886c33b
Fixed
9856c0de49052174ab474113f4ba40c02aaee086
Fixed
7aecdd47910c51707696e8b0e045b9f88bd4230f
Fixed
d51d2eeae4ce54d542909c4d9d07bf371a78592c
Fixed
4203722d51afe3d239e03f15cc73efdf023a7103
Fixed
456d8aa37d0f56fc9e985e812496e861dcd6f2f2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53446.json"