CVE-2023-52447: bpf: Defer the free of inner map when necessary

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.9affected
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before 90c445799fd1dc214d7c6279c144e33a35e29ef2affected · git
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before 37d98fb9c3144c0fddf7f6e99aece9927ac8dce6affected · git
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before 62fca83303d608ad4fec3f7428c8685680bb01b0affected · git
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before f91cd728b10c51f6d4a39957ccd56d1e802fc8eeaffected · git
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before bfd9b20c4862f41d4590fde11d70a5eeae53dcc5affected · git
  • bba1dc0b55ac462d24ed1228ad49800c238cd6d7 and later · before 876673364161da50eed6b472d746ef88242b2368affected · git
  • before 5.9not affected · semver
  • 5.10.214 and later · up to and including 5.10.*not affected · semver
  • 5.15.153 and later · up to and including 5.15.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-26592Feb 22, 2024 · ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
  31Monitor
• ← EarlierCVE-2023-52444Feb 22, 2024 · f2fs: fix to avoid dirent corruption
  31Monitor
• Later →CVE-2023-52452Feb 22, 2024 · bpf: Fix accesses to uninit stack slots
  31Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.