CVE-2023-52520

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: think-lmi: Fix reference leak

The Linux kernel CVE team has assigned CVE-2023-52520 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2023-52520-0a4e@gregkh/T/#u

This vulnerability is rated as Low severity because it requires specific Lenovo ThinkPad hardware and local access to be triggered, presenting limited opportunity for exploitation on standard enterprise deployments. The flaw occurs within the think-lmi platform driver during attribute enumeration when handling duplicate BIOS settings, leading to an unreleased internal reference. Because the issue is confined to a specialized platform driver and only causes a minor reference leak without impacting system integrity or confidentiality, the operational risk to Red Hat Enterprise Linux systems is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.