Use After Free in Linux

CVE-2023-53219

In the Linux kernel, the following vulnerability has been resolved: media: netup_unidvb: fix use-after-free at del_timer() When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync().

Vulnerability class: Use-After-Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (4.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-53219: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Linux — versions 52b1eaf4c59a3bbd07afbb4ab4f43418a807d02e, 4.3, 0
  • Linux Kernel — versions 6.4

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-53219?
CVE-2023-53219 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 7.8/10. Published 2025-09-15.
How severe is CVE-2023-53219?
High severity. CVSS v3 base score is 7.8 out of 10.