CVE-2023-53997

A flaw was found in the Linux kernel's thermal subsystem. A double-free vulnerability occurs during thermal zone device unregistration when using device tree (OF) bindings. The thermal_of_zone_register() function leaks the original tzp structure and double-frees the internal copy, which can lead to memory corruption or a kernel crash.

This vulnerability occurs during thermal zone unregistration, which typically happens during driver removal or system shutdown. The double-free requires triggering the unregistration path, and exploitation for anything beyond denial of service is highly unlikely. Systems not using device tree thermal zones are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.