Rapid7

vulnerability

Red Hat: CVE-2023-52475: kernel: use-after-free in powermate_config_complete (Multiple Advisories)

Severity
6
CVSS
(AV:L/AC:M/Au:M/C:C/I:C/A:C)
Published
Feb 29, 2024
Added
Dec 5, 2024
Modified
Mar 27, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Solutions

redhat-upgrade-kernelredhat-upgrade-kernel-rt
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.