CVE-2023-53594

A reference leak was found in the Linux kernel's driver core device registration logic. When kobject_add fails partway through device_add, the error cleanup attempts to free resources but fails because kobject_add has already cleared the device's parent pointer. This prevents cleanup_glue_dir from finding and releasing the glue directory's reference, causing permanent resource leaks that accumulate with repeated failures and eventually lead to denial of service.

The device_add function is the core device registration mechanism in Linux. It creates various sysfs structures, including "glue directories" that organize devices within the sysfs hierarchy. The flow looks like this: get_device_parent creates or finds a glue directory (incrementing its reference), sets dev->kobj.parent to point to it, then calls kobject_add to register the device kobject in sysfs. If kobject_add succeeds, everything's fine. But if it fails, it has a side effect: it sets dev->kobj.parent to NULL. The error cleanup then calls get_glue_dir to retrieve the glue directory so it can decrement the reference via cleanup_glue_dir. However, with dev->kobj.parent now NULL, get_glue_dir can't find the glue directory and returns NULL itself. cleanup_glue_dir checks for NULL and does nothing. The glue directory reference acquired earlier is never released.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.