Cyber Resilience

CVE-2023-52691

Memory Safety in Linux Kernel 4.9 – 4.19.306

Published
17 May 2024
Modified
10 January 2025
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 16th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-52691 is a high-severity Double Free (CWE-415) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in si_dpm_init When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it…

more

goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered.

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-49882Same product: Debian Debian Linux
CVE-2024-36940Same product: Debian Debian Linux
CVE-2025-38313Same product: Debian Debian Linux
CVE-2025-39914Same product: Debian Debian Linux
CVE-2025-39870Same product: Debian Debian Linux
CVE-2024-26846Same product: Debian Debian Linux
CVE-2025-38699Same product: Debian Debian Linux
CVE-2024-41073Same product: Debian Debian Linux
CVE-2024-49989Same product: Debian Debian Linux
CVE-2024-35847Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
4.9 — 4.19.306 · 4.20 — 5.4.268 · 5.5 — 5.10.209
debian
debian linux
10.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent double-free errors via static analysis, safe memory APIs, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect double-free conditions before release.

prevents

Secure development life cycle includes memory-safety practices that can prevent double-free bugs.

prevents

Application security requirements can mandate memory-safety rules that reduce double-free risk.

prevents

Secure system architecture and engineering principles can prescribe safe memory-management patterns.

prevents

Secure coding standards directly address proper use of free() and similar functions.

References