CVE-2023-53596

A resource management issue was found in the Linux kernel's driver core regarding device-managed (devm) resource cleanup. When devices without buses or drivers are unregistered, their managed resources aren't properly freed because devres_release_all is only called for devices that have been probed. This causes resource leaks—particularly problematic when managed resources hold references to the device itself—preventing device objects from ever being freed and leading to denial of service through resource exhaustion.

The device-managed resource API (devm) allows drivers to tie resource allocations to device lifetimes. Historically, devres_release_all was called only during driver unbinding (in the driver probe failure or remove paths). This worked fine for traditional bus-based, driver-bound devices. However, some subsystems—particularly DRM/graphics—use device objects without traditional bus/driver bindings. For these devices, if a devm resource holds a reference to the device, you get a circular dependency: the device can't be released until resources are freed, but resources won't be freed until the device is released. This actually triggered a previous fix attempt (commit 2f8d16a996da) that was later reverted (commit a525a3ddeaca) due to double-free issues. The current fix calls devres_release_all in both device_del (during unregistration) and device_release (during final teardown), breaking the circular dependency while avoiding the earlier problems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.