CVE-2023-54308 (GCVE-0-2023-54308)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-10-15 21:41
VLAI
Title
ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs"), but the call to snd_card_new() was not replaced with snd_devm_card_new(). Since there was no longer a call to snd_card_free, unloading the module would eventually result in Oops: [697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480 [697561.532893] #PF: supervisor read access in kernel mode [697561.532896] #PF: error_code(0x0000) - not-present page [697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0 [697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI [697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1 [697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022 [697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0 [697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f [697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246 [697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000 [697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a [697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 [697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 [697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80 [697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 [697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 [697561.532949] Call Trace: [697561.532951] <TASK> [697561.532955] try_module_get+0x13/0x30 [697561.532960] snd_ctl_open+0x61/0x1c0 [snd] [697561.532976] snd_open+0xb4/0x1e0 [snd] [697561.532989] chrdev_open+0xc7/0x240 [697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 [697561.533000] ? __pfx_chrdev_open+0x10/0x10 [697561.533005] do_dentry_open+0x169/0x440 [697561.533009] vfs_open+0x2d/0x40 [697561.533012] path_openat+0xa9d/0x10d0 [697561.533017] ? debug_smp_processor_id+0x17/0x20 [697561.533022] ? trigger_load_balance+0x65/0x370 [697561.533026] do_filp_open+0xb2/0x160 [697561.533032] ? _raw_spin_unlock+0x19/0x40 [697561.533036] ? alloc_fd+0xa9/0x190 [697561.533040] do_sys_openat2+0x9f/0x160 [697561.533044] __x64_sys_openat+0x55/0x90 [697561.533048] do_syscall_64+0x3b/0x90 [697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc [697561.533056] RIP: 0033:0x7f1308a40db4 [697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 [697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 [697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c [697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 [697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000 [697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000 [697561.533078] </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:40 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c6e6bb5eab7457a938c0405d5ccf319d3ee735c1 , < 95642872c466030240199ba796a40771c493ed0c (git)
Affected: c6e6bb5eab7457a938c0405d5ccf319d3ee735c1 , < db7d7782677ff998c06997903d5400a0ba91cebb (git)
Affected: c6e6bb5eab7457a938c0405d5ccf319d3ee735c1 , < 255a81a89501df77379b51a81c7a2e8e7c359bc6 (git)
Affected: c6e6bb5eab7457a938c0405d5ccf319d3ee735c1 , < f33fc1576757741479452255132d6e3aaf558ffe (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.106 , ≤ 5.15.* (semver)
Unaffected: 6.1.23 , ≤ 6.1.* (semver)
Unaffected: 6.2.10 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-54308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:40:14.270447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:41:44.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ymfpci/ymfpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95642872c466030240199ba796a40771c493ed0c",
              "status": "affected",
              "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
              "versionType": "git"
            },
            {
              "lessThan": "db7d7782677ff998c06997903d5400a0ba91cebb",
              "status": "affected",
              "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
              "versionType": "git"
            },
            {
              "lessThan": "255a81a89501df77379b51a81c7a2e8e7c359bc6",
              "status": "affected",
              "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
              "versionType": "git"
            },
            {
              "lessThan": "f33fc1576757741479452255132d6e3aaf558ffe",
              "status": "affected",
              "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ymfpci/ymfpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.106",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: Create card with device-managed snd_devm_card_new()\n\nsnd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 (\"ALSA:\nymfpci: Allocate resources with device-managed APIs\"), but the call to\nsnd_card_new() was not replaced with snd_devm_card_new().\n\nSince there was no longer a call to snd_card_free, unloading the module\nwould eventually result in Oops:\n\n[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480\n[697561.532893] #PF: supervisor read access in kernel mode\n[697561.532896] #PF: error_code(0x0000) - not-present page\n[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0\n[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G        W  OE      6.2.7 #1\n[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022\n[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0\n[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff \u003c41\u003e 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f\n[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246\n[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000\n[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a\n[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380\n[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480\n[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80\n[697561.532942] FS:  00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000\n[697561.532945] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0\n[697561.532949] Call Trace:\n[697561.532951]  \u003cTASK\u003e\n[697561.532955]  try_module_get+0x13/0x30\n[697561.532960]  snd_ctl_open+0x61/0x1c0 [snd]\n[697561.532976]  snd_open+0xb4/0x1e0 [snd]\n[697561.532989]  chrdev_open+0xc7/0x240\n[697561.532995]  ? fsnotify_perm.part.0+0x6e/0x160\n[697561.533000]  ? __pfx_chrdev_open+0x10/0x10\n[697561.533005]  do_dentry_open+0x169/0x440\n[697561.533009]  vfs_open+0x2d/0x40\n[697561.533012]  path_openat+0xa9d/0x10d0\n[697561.533017]  ? debug_smp_processor_id+0x17/0x20\n[697561.533022]  ? trigger_load_balance+0x65/0x370\n[697561.533026]  do_filp_open+0xb2/0x160\n[697561.533032]  ? _raw_spin_unlock+0x19/0x40\n[697561.533036]  ? alloc_fd+0xa9/0x190\n[697561.533040]  do_sys_openat2+0x9f/0x160\n[697561.533044]  __x64_sys_openat+0x55/0x90\n[697561.533048]  do_syscall_64+0x3b/0x90\n[697561.533052]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n[697561.533056] RIP: 0033:0x7f1308a40db4\n[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44\n[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101\n[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4\n[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c\n[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012\n[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000\n[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000\n[697561.533078]  \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable dereference is reached by opening the still-registered ALSA character devices (/dev/snd/controlC*, pcmC*) via the open()/ioctl syscall path, and the underlying stale state is created by local driver detach. No network or adjacent-network input is involved.\nAC:L - There is no race to win and no memory-layout precondition: once the driver detaches, the card, its minors and its dangling module/iomap/DMA pointers persist indefinitely, so a single open() deterministically hits the freed module struct. The reporter hit it accidentally with an ordinary userspace audio daemon.\nPR:L - The fatal use-after-free is performed by whoever opens /dev/snd/controlC0, which any unprivileged user in the audio group or holding the standard udev/logind ACL can do (pipewire/wireplumber do it automatically). Only the setup step (module unload/unbind) is administrative; no privilege is needed to perform the dereference itself.\nUI:N - Exploitation requires only the attacker\u0027s own open() syscall on the leftover device node; no victim action, file, or mount is needed. In the reported case the crash occurred with no interactive user involvement at all.\nS:U - The corruption and the crash are entirely within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel memory-safety defect.\nC:H - This is a use-after-free: try_module_get() reads the freed and potentially reallocated module structure, and the chip\u0027s still-enabled DSP keeps DMAing into pages already returned to the page allocator, exposing recycled kernel memory contents through the still-live PCM/control interfaces. Per UAF guidance this is High.\nI:H - try_module_get() performs atomic_inc_not_zero() into freed module memory, and, because snd_ymfpci_free() never runs, the hardware continues DMA-writing into DMA pages that devres already released back to the allocator \u2014 arbitrary corruption of reallocated kernel memory that is leverageable beyond a mere crash.\nA:H - The commit message documents a reproducible kernel Oops (page fault in try_module_get from snd_ctl_open) on any open of the leftover control device, and the orphaned shared IRQ plus ongoing DMA add further instability. Any kernel oops or panic is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:19:08.567Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95642872c466030240199ba796a40771c493ed0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/db7d7782677ff998c06997903d5400a0ba91cebb"
        },
        {
          "url": "https://git.kernel.org/stable/c/255a81a89501df77379b51a81c7a2e8e7c359bc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f33fc1576757741479452255132d6e3aaf558ffe"
        }
      ],
      "title": "ALSA: ymfpci: Create card with device-managed snd_devm_card_new()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54308",
    "datePublished": "2025-12-30T12:23:41.163Z",
    "dateReserved": "2025-12-30T12:06:44.530Z",
    "dateUpdated": "2026-10-15T21:41:44.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54308",
      "date": "2026-11-13",
      "epss": "0.00154",
      "percentile": "0.04586"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/pci/ymfpci/ymfpci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "95642872c466030240199ba796a40771c493ed0c",
                    "status": "affected",
                    "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db7d7782677ff998c06997903d5400a0ba91cebb",
                    "status": "affected",
                    "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "255a81a89501df77379b51a81c7a2e8e7c359bc6",
                    "status": "affected",
                    "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f33fc1576757741479452255132d6e3aaf558ffe",
                    "status": "affected",
                    "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/pci/ymfpci/ymfpci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.106",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: Create card with device-managed snd_devm_card_new()\n\nsnd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 (\"ALSA:\nymfpci: Allocate resources with device-managed APIs\"), but the call to\nsnd_card_new() was not replaced with snd_devm_card_new().\n\nSince there was no longer a call to snd_card_free, unloading the module\nwould eventually result in Oops:\n\n[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480\n[697561.532893] #PF: supervisor read access in kernel mode\n[697561.532896] #PF: error_code(0x0000) - not-present page\n[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0\n[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G        W  OE      6.2.7 #1\n[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022\n[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0\n[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff \u003c41\u003e 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f\n[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246\n[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000\n[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a\n[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380\n[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480\n[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80\n[697561.532942] FS:  00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000\n[697561.532945] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0\n[697561.532949] Call Trace:\n[697561.532951]  \u003cTASK\u003e\n[697561.532955]  try_module_get+0x13/0x30\n[697561.532960]  snd_ctl_open+0x61/0x1c0 [snd]\n[697561.532976]  snd_open+0xb4/0x1e0 [snd]\n[697561.532989]  chrdev_open+0xc7/0x240\n[697561.532995]  ? fsnotify_perm.part.0+0x6e/0x160\n[697561.533000]  ? __pfx_chrdev_open+0x10/0x10\n[697561.533005]  do_dentry_open+0x169/0x440\n[697561.533009]  vfs_open+0x2d/0x40\n[697561.533012]  path_openat+0xa9d/0x10d0\n[697561.533017]  ? debug_smp_processor_id+0x17/0x20\n[697561.533022]  ? trigger_load_balance+0x65/0x370\n[697561.533026]  do_filp_open+0xb2/0x160\n[697561.533032]  ? _raw_spin_unlock+0x19/0x40\n[697561.533036]  ? alloc_fd+0xa9/0x190\n[697561.533040]  do_sys_openat2+0x9f/0x160\n[697561.533044]  __x64_sys_openat+0x55/0x90\n[697561.533048]  do_syscall_64+0x3b/0x90\n[697561.533052]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n[697561.533056] RIP: 0033:0x7f1308a40db4\n[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44\n[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101\n[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4\n[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c\n[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012\n[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000\n[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000\n[697561.533078]  \u003c/TASK\u003e"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: ymfpci: Crear tarjeta con snd_devm_card_new() gestionada por dispositivo\n\nsnd_card_ymfpci_remove() fue eliminada en el commit c6e6bb5eab74 (\u0027ALSA: ymfpci: Asignar recursos con APIs gestionadas por dispositivo\u0027), pero la llamada a snd_card_new() no fue reemplazada por snd_devm_card_new().\n\nDado que ya no hab\u00eda una llamada a snd_card_free, la descarga del m\u00f3dulo eventualmente resultar\u00eda en un Oops:\n\n[697561.532887] BUG: incapaz de manejar fallo de p\u00e1gina para la direcci\u00f3n: ffffffffc0924480\n[697561.532893] #PF: acceso de lectura de supervisor en modo kernel\n[697561.532896] #PF: c\u00f3digo_de_error(0x0000) - p\u00e1gina no presente\n[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0\n[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G        W  OE      6.2.7 #1\n[697561.532914] Nombre de hardware: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022\n[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0\n[697561.532924] C\u00f3digo: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff \u0026lt;41\u0026gt; 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f\n [697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246 [697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000 [697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a [697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 [697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 [697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80 [697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 [697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 [697561.532949] Call Trace: [697561.532951]  [697561.532955] try_module_get+0x13/0x30 [697561.532960] snd_ctl_open+0x61/0x1c0 [snd] [697561.532976] snd_open+0xb4/0x1e0 [snd] [697561.532989] chrdev_open+0xc7/0x240 [697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 [697561.533000] ? __pfx_chrdev_open+0x10/0x10 [697561.533005] do_dentry_open+0x169/0x440 [697561.533009] vfs_open+0x2d/0x40 [697561.533012] path_openat+0xa9d/0x10d0 [697561.533017] ? debug_smp_processor_id+0x17/0x20 [697561.533022] ? trigger_load_balance+0x65/0x370 [697561.533026] do_filp_open+0xb2/0x160 [697561.533032] ? _raw_spin_unlock+0x19/0x40 [697561.533036] ? alloc_fd+0xa9/0x190 [697561.533040] do_sys_openat2+0x9f/0x160 [697561.533044] __x64_sys_openat+0x55/0x90 [697561.533048] do_syscall_64+0x3b/0x90 [697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc [697561.533056] RIP: 0033:0x7f1308a40db4 [697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 [697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 [697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c [697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 [697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000 [697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000 [697561.533078] "
          }
        ],
        "id": "CVE-2023-54308",
        "lastModified": "2026-10-15T22:17:57.917",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-54308",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:40:14.270447Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-30T13:16:19.973",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/255a81a89501df77379b51a81c7a2e8e7c359bc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95642872c466030240199ba796a40771c493ed0c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db7d7782677ff998c06997903d5400a0ba91cebb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f33fc1576757741479452255132d6e3aaf558ffe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T11:11:25+00:00",
      "cve": "CVE-2023-54308",
      "id": "CVE-2023-54308",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "125",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: ymfpci: Create card with device-managed snd_devm_card_new()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54308.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-54308",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:40:14.270447Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:40:15.097Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "sound/pci/ymfpci/ymfpci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "95642872c466030240199ba796a40771c493ed0c",
                  "status": "affected",
                  "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                  "versionType": "git"
                },
                {
                  "lessThan": "db7d7782677ff998c06997903d5400a0ba91cebb",
                  "status": "affected",
                  "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                  "versionType": "git"
                },
                {
                  "lessThan": "255a81a89501df77379b51a81c7a2e8e7c359bc6",
                  "status": "affected",
                  "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                  "versionType": "git"
                },
                {
                  "lessThan": "f33fc1576757741479452255132d6e3aaf558ffe",
                  "status": "affected",
                  "version": "c6e6bb5eab7457a938c0405d5ccf319d3ee735c1",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "sound/pci/ymfpci/ymfpci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.15"
                },
                {
                  "lessThan": "5.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.106",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.23",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.*",
                  "status": "unaffected",
                  "version": "6.2.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.106",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.23",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2.10",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.3",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: Create card with device-managed snd_devm_card_new()\n\nsnd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 (\"ALSA:\nymfpci: Allocate resources with device-managed APIs\"), but the call to\nsnd_card_new() was not replaced with snd_devm_card_new().\n\nSince there was no longer a call to snd_card_free, unloading the module\nwould eventually result in Oops:\n\n[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480\n[697561.532893] #PF: supervisor read access in kernel mode\n[697561.532896] #PF: error_code(0x0000) - not-present page\n[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0\n[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G        W  OE      6.2.7 #1\n[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022\n[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0\n[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff \u003c41\u003e 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f\n[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246\n[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000\n[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a\n[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380\n[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480\n[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80\n[697561.532942] FS:  00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000\n[697561.532945] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0\n[697561.532949] Call Trace:\n[697561.532951]  \u003cTASK\u003e\n[697561.532955]  try_module_get+0x13/0x30\n[697561.532960]  snd_ctl_open+0x61/0x1c0 [snd]\n[697561.532976]  snd_open+0xb4/0x1e0 [snd]\n[697561.532989]  chrdev_open+0xc7/0x240\n[697561.532995]  ? fsnotify_perm.part.0+0x6e/0x160\n[697561.533000]  ? __pfx_chrdev_open+0x10/0x10\n[697561.533005]  do_dentry_open+0x169/0x440\n[697561.533009]  vfs_open+0x2d/0x40\n[697561.533012]  path_openat+0xa9d/0x10d0\n[697561.533017]  ? debug_smp_processor_id+0x17/0x20\n[697561.533022]  ? trigger_load_balance+0x65/0x370\n[697561.533026]  do_filp_open+0xb2/0x160\n[697561.533032]  ? _raw_spin_unlock+0x19/0x40\n[697561.533036]  ? alloc_fd+0xa9/0x190\n[697561.533040]  do_sys_openat2+0x9f/0x160\n[697561.533044]  __x64_sys_openat+0x55/0x90\n[697561.533048]  do_syscall_64+0x3b/0x90\n[697561.533052]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n[697561.533056] RIP: 0033:0x7f1308a40db4\n[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44\n[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101\n[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4\n[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c\n[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012\n[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000\n[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000\n[697561.533078]  \u003c/TASK\u003e"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable dereference is reached by opening the still-registered ALSA character devices (/dev/snd/controlC*, pcmC*) via the open()/ioctl syscall path, and the underlying stale state is created by local driver detach. No network or adjacent-network input is involved.\nAC:L - There is no race to win and no memory-layout precondition: once the driver detaches, the card, its minors and its dangling module/iomap/DMA pointers persist indefinitely, so a single open() deterministically hits the freed module struct. The reporter hit it accidentally with an ordinary userspace audio daemon.\nPR:L - The fatal use-after-free is performed by whoever opens /dev/snd/controlC0, which any unprivileged user in the audio group or holding the standard udev/logind ACL can do (pipewire/wireplumber do it automatically). Only the setup step (module unload/unbind) is administrative; no privilege is needed to perform the dereference itself.\nUI:N - Exploitation requires only the attacker\u0027s own open() syscall on the leftover device node; no victim action, file, or mount is needed. In the reported case the crash occurred with no interactive user involvement at all.\nS:U - The corruption and the crash are entirely within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel memory-safety defect.\nC:H - This is a use-after-free: try_module_get() reads the freed and potentially reallocated module structure, and the chip\u0027s still-enabled DSP keeps DMAing into pages already returned to the page allocator, exposing recycled kernel memory contents through the still-live PCM/control interfaces. Per UAF guidance this is High.\nI:H - try_module_get() performs atomic_inc_not_zero() into freed module memory, and, because snd_ymfpci_free() never runs, the hardware continues DMA-writing into DMA pages that devres already released back to the allocator \u2014 arbitrary corruption of reallocated kernel memory that is leverageable beyond a mere crash.\nA:H - The commit message documents a reproducible kernel Oops (page fault in try_module_get from snd_ctl_open) on any open of the leftover control device, and the orphaned shared IRQ plus ongoing DMA add further instability. Any kernel oops or panic is High."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:19:08.567Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/95642872c466030240199ba796a40771c493ed0c"
            },
            {
              "url": "https://git.kernel.org/stable/c/db7d7782677ff998c06997903d5400a0ba91cebb"
            },
            {
              "url": "https://git.kernel.org/stable/c/255a81a89501df77379b51a81c7a2e8e7c359bc6"
            },
            {
              "url": "https://git.kernel.org/stable/c/f33fc1576757741479452255132d6e3aaf558ffe"
            }
          ],
          "title": "ALSA: ymfpci: Create card with device-managed snd_devm_card_new()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-54308",
        "datePublished": "2025-12-30T12:23:41.163Z",
        "dateReserved": "2025-12-30T12:06:44.530Z",
        "dateUpdated": "2026-10-15T21:41:44.493Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.