Refcount Leak in Linux Kernel's SiFive GPIO Driver

CVE-2023-53592

What is CVE-2023-53592?

A vulnerability has been identified in the SiFive GPIO driver of the Linux kernel, where a reference count leak may occur due to improper handling of node pointers returned by the of_irq_find_parent() function. Specifically, the driver fails to call of_node_put() when the node pointer is no longer needed, which can lead to resource management issues. This vulnerability has been addressed by adding the necessary of_node_put() calls to prevent any potential leaks in reference counts.

References