CVE-2023-53572

A use-after-free flaw was found in the Linux kernel's i.MX system control unit clock driver in the error cleanup path. A local user can trigger this issue during clock initialization failure scenarios on i.MX hardware with System Control Unit firmware, where the cleanup loop incorrectly uses a standard list iterator instead of the safe variant while freeing clock structures. This causes the kernel to dereference freed memory when traversing to the next list element, resulting in memory corruption that can lead to a crash or denial of service.

The bug appears in the cleanup path that executes when SCU clock registration fails. The code walks a linked list of clock structures, freeing each one, but uses list_for_each_entry() instead of list_for_each_entry_safe(). Since the macro dereferences the current entry to find the next pointer, freeing the entry first creates a use-after-free when the loop tries to advance. Exploitation requires triggering a clock initialization failure, which typically happens only during early boot on specific i.MX platforms with SCU firmware (like i.MX8QM or i.MX8QXP).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.