{"id":"CVE-2023-53805","summary":"tty: n_gsm: fix UAF in gsm_cleanup_mux","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix UAF in gsm_cleanup_mux\n\nIn gsm_cleanup_mux() the 'gsm-\u003edlci' pointer was not cleaned properly,\nleaving it a dangling pointer after gsm_dlci_release.\nThis leads to use-after-free where 'gsm-\u003edlci[0]' are freed and accessed\nby the subsequent gsm_cleanup_mux().\n\nSuch is the case in the following call trace:\n\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\n print_address_description+0x63/0x3b0 mm/kasan/report.c:248\n __kasan_report mm/kasan/report.c:434 [inline]\n kasan_report+0x16b/0x1c0 mm/kasan/report.c:451\n gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397\n gsm_config drivers/tty/n_gsm.c:2653 [inline]\n gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986\n tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\n \u003c/TASK\u003e\n\nAllocated by task 3501:\n kasan_save_stack mm/kasan/common.c:38 [inline]\n kasan_set_track mm/kasan/common.c:46 [inline]\n set_alloc_info mm/kasan/common.c:434 [inline]\n ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513\n kasan_kmalloc include/linux/kasan.h:264 [inline]\n kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247\n kmalloc include/linux/slab.h:591 [inline]\n kzalloc include/linux/slab.h:721 [inline]\n gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932\n gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438\n gsm_config drivers/tty/n_gsm.c:2677 [inline]\n gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986\n tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\n\nFreed by task 3501:\n kasan_save_stack mm/kasan/common.c:38 [inline]\n kasan_set_track+0x4b/0x80 mm/kasan/common.c:46\n kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360\n ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366\n kasan_slab_free include/linux/kasan.h:230 [inline]\n slab_free_hook mm/slub.c:1705 [inline]\n slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731\n slab_free mm/slub.c:3499 [inline]\n kfree+0xf1/0x270 mm/slub.c:4559\n dlci_put drivers/tty/n_gsm.c:1988 [inline]\n gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline]\n gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415\n gsm_config drivers/tty/n_gsm.c:2653 [inline]\n gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986\n tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x61/0xcb","modified":"2026-04-10T05:07:00.751492Z","published":"2025-12-09T00:01:03.422Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53805.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5138c228311a863c3cf937b94a3ab4c87f1f70c4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/74a8d6f50cc90ed0061997db51dfa81a62b0f835"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8fc0eabaa73bbd9bd705577071564616da5c8c61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9615ca54bc138e35353a001e8b5d4824dce72188"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9b9c8195f3f0d74a826077fc1c01b9ee74907239"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53805.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53805"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"47132f9f7f766718513625982468f7f1339ca666"},{"fixed":"8fc0eabaa73bbd9bd705577071564616da5c8c61"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7f71387d9f3bd83e183d38f7dd7b05165900fc03"},{"fixed":"5138c228311a863c3cf937b94a3ab4c87f1f70c4"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"aa371e96f05dcb36a88298f5cb70aa7234d5e8b8"},{"fixed":"9615ca54bc138e35353a001e8b5d4824dce72188"},{"fixed":"74a8d6f50cc90ed0061997db51dfa81a62b0f835"},{"fixed":"9b9c8195f3f0d74a826077fc1c01b9ee74907239"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"74ef1629c5ab5c89ac241d434dbb3ec150df695a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53805.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.190"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.124"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.43"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"6.4.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53805.json"}}],"schema_version":"1.7.5"}