{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-53314",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-53314"
  ],
  "published": "2025-09-16T16:13:45Z",
  "summary": "fbdev/ep93xx-fb: Do not assign to struct fb_info.dev",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev/ep93xx-fb: Do not assign to struct fb_info.dev\n\nDo not assing the Linux device to struct fb_info.dev. The call to\nregister_framebuffer() initializes the field to the fbdev device.\nDrivers should not override its value.\n\nFixes a bug where the driver incorrectly decreases the hardware\ndevice's reference counter and leaks the fbdev device.\n\nv2:\n\t* add Fixes tag (Dan)",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.54",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53314"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ffdf2b020db717853167391a3a8d912e13428fa6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1c6ff2a7c593db851f23e31ace2baf557ea9d0ff"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8ffa40ff64aa43a9a28fcf209b48d86a3e0f4972"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4aade6c9100a3537788b6a9c7ac481037d19efdf"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/309c27162afea79b3c7f8747bb650faf6923b639"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f83c1b13f8154e0284448912756d0a351a1a602a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0517fc5a71333b315164736bbd32608894fbb872"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f90a0e5265b60cdd3c77990e8105f79aa2fac994"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is in the ep93xx-fb platform driver probe/remove path for the on-SoC Cirrus EP93xx LCD controller; it is reached only locally via boot probe, module load, or sysfs bind/unbind, with no network or hot-plug physical entry point.\nAC:L - The incorrect info->dev assignment and resulting device refcount imbalance are deterministic on probe/unregister; the attacker does not depend on a race or an uncontrolled memory layout.\nPR:L - Although sysfs bind/unbind is root-owned 0200, the highest reasonable actor is a low-privileged local user on an EP93xx system where the framebuffer is already bound and /dev/fbN is usable, so PR:L is chosen over PR:H.\nUI:N - Exploitation does not require a separate victim action such as mounting a filesystem or manually opening a device beyond the attacker\u2019s own local access.\nS:U - Impact stays within the host kernel\u2019s device/refcount authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - Incorrectly dropping the hardware device\u2019s reference count can free the live platform device while fbdev code still uses it, yielding a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same device UAF is exploitable for heap reuse and arbitrary write/control-flow hijack primitives against kernel memory, not merely a benign bookkeeping error.\nA:H - A device UAF or bad put on the platform device can oops/panic the kernel on unregister or later fbdev use, and the companion fbdev device leak is secondary to that crash impact."
    }
  }
}