CVE-2023-53613

A use-after-free vulnerability was found in the Linux kernel's device-dax subsystem during mapping object cleanup. When removing a dax region provider, the child dax_mapping objects attempt to free their ID allocator after the parent dev_dax object has already been released. This causes ida_free to operate on freed memory, triggering lockdep warnings and potentially causing crashes or memory corruption, leading to denial of service.

The device-dax subsystem manages mappings of persistent memory regions. The parent-child relationship between dev_dax instances and their dax_mapping children follows the typical device model pattern: children hold references to parents while registered. However, dax_mapping objects were violating this pattern. When kobject delayed cleanup triggered dax_mapping_release (potentially seconds after the mapping was logically removed), it called ida_free on an ida structure that was part of the now-freed parent dev_dax object. The freed parent's memory could have been reallocated for other purposes, making the ida_free operate on arbitrary data structures. The issue manifests clearly under CONFIG_DEBUG_KOBJECT_RELEASE testing, which delays kobject cleanup to expose such bugs. Under normal conditions it creates a window where use-after-free could occur. The fix ensures dax_mapping holds an explicit reference on its parent that's only dropped during the final release callback.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.