CVE-2023-52475: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Affected products

• Linux Linux Kernel: before 4.14.328 (fixed in 4.14.328); from 4.15, before 4.19.297 (fixed in 4.19.297); from 4.20, before 5.4.259 (fixed in 5.4.259); from 5.5, before 5.10.199 (fixed in 5.10.199); from 5.11, before 5.15.136 (fixed in 5.15.136); from 5.16, before 6.1.59 (fixed in 6.1.59); …

Published 2024-02-29. Last modified 2026-06-17.