Use After Free in Linux
CVE-2023-53037
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topology results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data structure. However, in some places, the reference to the freed memory is not cleared. When the firmware sends the Device Info change event for the same device again, the freed memory is accessed and that leads to memory corruption and OS crash.
Vulnerability class: Use-After-Free
EPSS: 0.002 (8.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions c4f7ac64616ee513f9ac4ae6c4d8c3cccb6974df, 5.14, 0
- Linux Linux_kernel — versions 6.3
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-53037?
- CVE-2023-53037 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 7.8/10. Published 2025-05-02.
- How severe is CVE-2023-53037?
- High severity. CVSS v3 base score is 7.8 out of 10.