🛡️ CVE-2023-52617 — debian-linux

🟡 CVSS 4.4 — Medium ✅ No Known Exploit CWE-459 NVD

4.4

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

PCI: switchtec: Fix stdev_release() crash after surprise hot remove

In the Linux kernel, the following vulnerability has been resolved:

PCI: switchtec: Fix stdev_release() crash after surprise hot remove

A PCI device hot removal may occur while stdev->cdev is held open. The call

to stdev_release() then happens during close or exit, at a point way past

switchtec_pci_remove(). Otherwise the last ref would vanish with the

trailing put_device(), just before return.

At that later point in time, the devm cleanup has already removed the

stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted

one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause

a fatal page fault, and the subsequent dma_free_coherent(), if reached,

would pass a stale &stdev->pdev->dev pointer.

Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after

stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent

future accidents.

Reproducible via the script at

https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs administrative privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

Weakness class

CVE-2023-52617 is classified as CWE-459: Incomplete Cleanup. Temporary state is not fully removed after use, leaving data or resources behind.

Affected software

CVE-2023-52617 is recorded against 3 packages.

debian-linux
kernel (from 6.7.0 up to 6.7.4)
linux-kernel (from 6.7 up to 6.7.4)

Timeline and source

Published on 18 March 2024 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
lists.debian.org

CVE-2023-52617 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

BellSoft Debian Ubuntu

Details

Severity MEDIUM

CVSS Score 4.4

CVSS Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE CWE-459

Public Exploit ✅ No

Source NVD

Published 2024-03-18

Updated 2026-08-12

Modified 2026-06-17

Fix URL https://git.kernel.org/stable/c/0233b836312e39a3c763fb53512b3fa455b473b3

Affected Packages

Software	From version	Fixed in
debian-linux	—	—
kernel	6.7.0	6.7.4
linux-kernel	6.7	6.7.4

References

Patch https://git.kernel.org/stable/c/0233b836312e39a3c763fb53512b3fa455b473b3

Patch https://git.kernel.org/stable/c/1d83c85922647758c1f1e4806a4c5c3cf591a20a

Patch https://git.kernel.org/stable/c/4a5d0528cf19dbf060313dffbe047bc11c90c24c

Patch https://git.kernel.org/stable/c/d8c293549946ee5078ed0ab77793cec365559355

Patch https://git.kernel.org/stable/c/df25461119d987b8c81d232cfe4411e91dcabe66

Patch https://git.kernel.org/stable/c/e129c7fa7070fbce57feb0bfc5eaa65eef44b693

Patch https://git.kernel.org/stable/c/ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8

Patch https://git.kernel.org/stable/c/0233b836312e39a3c763fb53512b3fa455b473b3

Patch https://git.kernel.org/stable/c/1d83c85922647758c1f1e4806a4c5c3cf591a20a

Patch https://git.kernel.org/stable/c/4a5d0528cf19dbf060313dffbe047bc11c90c24c

Patch https://git.kernel.org/stable/c/d8c293549946ee5078ed0ab77793cec365559355

Patch https://git.kernel.org/stable/c/df25461119d987b8c81d232cfe4411e91dcabe66

Patch https://git.kernel.org/stable/c/e129c7fa7070fbce57feb0bfc5eaa65eef44b693

Patch https://git.kernel.org/stable/c/ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8

Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in debian-linux

CVE-2023-52617 is rated CVSS 4.4 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.