Resource Management Flaw in Atmel QuadSPI Driver of Linux Kernel

CVE-2023-53758

What is CVE-2023-53758?

A vulnerability in the Atmel QuadSPI driver of the Linux Kernel could lead to improper resource management during device removal. Specifically, if the runtime resume fails, the driver does not prevent the unbinding of the device. This results in an SPI controller that has an unbound parent and unmapped register space, potentially leading to operational inconsistencies when the remaining SPI controller is engaged. To address this, the driver should unregister the controller unconditionally and avoid hardware access and clock disable, while also providing warnings about resume failure to suppress misleading error messages.

References