GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53012 (GCVE-0-2023-53012)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:43 – Updated: 2026-05-27 09:27
VLAI
Title
thermal: core: call put_device() only after device_register() fails
Summary
In the Linux kernel, the following vulnerability has been resolved: thermal: core: call put_device() only after device_register() fails put_device() shouldn't be called before a prior call to device_register(). __thermal_cooling_device_register() doesn't follow that properly and needs fixing. Also thermal_cooling_device_destroy_sysfs() is getting called unnecessarily on few error paths. Fix all this by placing the calls at the right place. Based on initial work done by Caleb Connolly.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 108a6f91e2766a6d9142b1f2d90c07ac547eae7e , < a7d736cc3c6cb0d7498bbfb56515d414e35e9510 (git)
Affected: 80bb3b901abe6560620505e5c734d140c4f73a07 , < 2846a7412f6246fd5171f51011bf76dfebcec0ee (git)
Affected: c408b3d1d9bbc7de5fb0304fea424ef2539da616 , < 6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8 (git)
Affected: 5139cbc0c6e4bf2fcffc9a7ed4350bf6985bc561 (git)
Affected: c4c435d3637b5d0abaa6447c7366c3674364968a (git)
Affected: e0d8b51bbe84d6a98c162e06344de2d773d9e722 (git)
Affected: 6.0.16 , < 6.1 (semver)
guessed Create a notification for this product.
Linux Linux guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7d736cc3c6cb0d7498bbfb56515d414e35e9510",
              "status": "affected",
              "version": "108a6f91e2766a6d9142b1f2d90c07ac547eae7e",
              "versionType": "git"
            },
            {
              "lessThan": "2846a7412f6246fd5171f51011bf76dfebcec0ee",
              "status": "affected",
              "version": "80bb3b901abe6560620505e5c734d140c4f73a07",
              "versionType": "git"
            },
            {
              "lessThan": "6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8",
              "status": "affected",
              "version": "c408b3d1d9bbc7de5fb0304fea424ef2539da616",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5139cbc0c6e4bf2fcffc9a7ed4350bf6985bc561",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c4c435d3637b5d0abaa6447c7366c3674364968a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e0d8b51bbe84d6a98c162e06344de2d773d9e722",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: call put_device() only after device_register() fails\n\nput_device() shouldn\u0027t be called before a prior call to\ndevice_register(). __thermal_cooling_device_register() doesn\u0027t follow\nthat properly and needs fixing. Also\nthermal_cooling_device_destroy_sysfs() is getting called unnecessarily\non few error paths.\n\nFix all this by placing the calls at the right place.\n\nBased on initial work done by Caleb Connolly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T09:27:35.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7d736cc3c6cb0d7498bbfb56515d414e35e9510"
        },
        {
          "url": "https://git.kernel.org/stable/c/2846a7412f6246fd5171f51011bf76dfebcec0ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8"
        }
      ],
      "title": "thermal: core: call put_device() only after device_register() fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53012",
    "datePublished": "2025-03-27T16:43:41.693Z",
    "dateReserved": "2025-03-27T16:40:15.749Z",
    "dateUpdated": "2026-05-27T09:27:35.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53012",
      "date": "2026-09-13",
      "epss": "0.00201",
      "percentile": "0.10062"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T01:42:44.000Z",
      "cve": "CVE-2023-53012",
      "id": "msrc_CVE-2023-53012",
      "initial_release_date": "2025-11-01T01:01:36.000Z",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "thermal: core: call put_device() only after device_register() fails",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2023-53012.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53012\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T17:15:50.290\",\"lastModified\":\"2026-06-17T06:44:06.957\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nthermal: core: call put_device() only after device_register() fails\\n\\nput_device() shouldn\u0027t be called before a prior call to\\ndevice_register(). __thermal_cooling_device_register() doesn\u0027t follow\\nthat properly and needs fixing. Also\\nthermal_cooling_device_destroy_sysfs() is getting called unnecessarily\\non few error paths.\\n\\nFix all this by placing the calls at the right place.\\n\\nBased on initial work done by Caleb Connolly.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: llamar a put_device() solo despu\u00e9s de que device_register() falle. No se debe llamar a put_device() antes de una llamada previa a device_register(). __thermal_cooling_device_register() no sigue esto correctamente y necesita soluci\u00f3n. Adem\u00e1s, se llama a thermal_cooling_device_destroy_sysfs() innecesariamente en algunas rutas de error. Para solucionar esto, coloque las llamadas en el lugar correcto. Basado en el trabajo inicial de Caleb Connolly.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/thermal/thermal_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"108a6f91e2766a6d9142b1f2d90c07ac547eae7e\",\"lessThan\":\"a7d736cc3c6cb0d7498bbfb56515d414e35e9510\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"80bb3b901abe6560620505e5c734d140c4f73a07\",\"lessThan\":\"2846a7412f6246fd5171f51011bf76dfebcec0ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c408b3d1d9bbc7de5fb0304fea424ef2539da616\",\"lessThan\":\"6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5139cbc0c6e4bf2fcffc9a7ed4350bf6985bc561\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4c435d3637b5d0abaa6447c7366c3674364968a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0d8b51bbe84d6a98c162e06344de2d773d9e722\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/thermal/thermal_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\"}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.86\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"5CC2C8BB-D873-4C7B-BC81-AE5284347127\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1\",\"matchCriteriaId\":\"6C7522E3-150F-436D-BBD7-96C7B4B795ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.2\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"23462883-7E53-4A2B-8F32-9DC8F9B92E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2846a7412f6246fd5171f51011bf76dfebcec0ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7d736cc3c6cb0d7498bbfb56515d414e35e9510\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-21T19:11:29+00:00",
      "cve": "CVE-2023-53012",
      "id": "CVE-2023-53012",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: thermal: core: call put_device() only after device_register() fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53012.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.