CVE-2023-53567

An incorrect error handling flaw was found in the Linux kernel's Qualcomm SPI driver in the device removal path. A local privileged user who triggers device removal when the hardware fails to wake can cause DMA resources to leak permanently, as the driver returns early from the cleanup callback without releasing allocated resources. This leads to resource exhaustion and denial of service through repeated device removal operations or system reboot scenarios.

The bug occurs in the platform driver's remove callback, which is invoked during device unbinding or system shutdown. When the code attempts to wake the device and that operation fails, it returns immediately without proceeding to DMA resource cleanup. Since remove callbacks are never retried, these resources remain allocated indefinitely. This creates a permanent memory leak that accumulates across device hotplug cycles or module unload/reload sequences. Triggering requires the ability to unbind devices or unload modules, typically requiring root privileges or specific udev configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.