{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2023-53123",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-05-02T15:51:43.555Z",
        "datePublished": "2025-05-02T15:55:59.580Z",
        "dateUpdated": "2026-05-11T19:38:56.432Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T19:38:56.432Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: s390: Fix use-after-free of PCI resources with per-function hotplug\n\nOn s390 PCI functions may be hotplugged individually even when they\nbelong to a multi-function device. In particular on an SR-IOV device VFs\nmay be removed and later re-added.\n\nIn commit a50297cf8235 (\"s390/pci: separate zbus creation from\nscanning\") it was missed however that struct pci_bus and struct\nzpci_bus's resource list retained a reference to the PCI functions MMIO\nresources even though those resources are released and freed on\nhot-unplug. These stale resources may subsequently be claimed when the\nPCI function re-appears resulting in use-after-free.\n\nOne idea of fixing this use-after-free in s390 specific code that was\ninvestigated was to simply keep resources around from the moment a PCI\nfunction first appeared until the whole virtual PCI bus created for\na multi-function device disappears. The problem with this however is\nthat due to the requirement of artificial MMIO addreesses (address\ncookies) extra logic is then needed to keep the address cookies\ncompatible on re-plug. At the same time the MMIO resources semantically\nbelong to the PCI function so tying their lifecycle to the function\nseems more logical.\n\nInstead a simpler approach is to remove the resources of an individually\nhot-unplugged PCI function from the PCI bus's resource list while\nkeeping the resources of other PCI functions on the PCI bus untouched.\n\nThis is done by introducing pci_bus_remove_resource() to remove an\nindividual resource. Similarly the resource also needs to be removed\nfrom the struct zpci_bus's resource list. It turns out however, that\nthere is really no need to add the MMIO resources to the struct\nzpci_bus's resource list at all and instead we can simply use the\nzpci_bar_struct's resource pointer directly."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/s390/pci/pci.c",
                        "arch/s390/pci/pci_bus.c",
                        "arch/s390/pci/pci_bus.h",
                        "drivers/pci/bus.c",
                        "include/linux/pci.h"
                    ],
                    "versions": [
                        {
                            "version": "a50297cf8235b062bcdeaa8b1dad58e69d3e1b43",
                            "lessThan": "437bb839e36cc9f35adc6d2a2bf113b7a0fc9985",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a50297cf8235b062bcdeaa8b1dad58e69d3e1b43",
                            "lessThan": "a2410d0c3d2d714ed968a135dfcbed6aa3ff7027",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a50297cf8235b062bcdeaa8b1dad58e69d3e1b43",
                            "lessThan": "b99ebf4b62774e690e73a551cf5fbf6f219bdd96",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a50297cf8235b062bcdeaa8b1dad58e69d3e1b43",
                            "lessThan": "ab909509850b27fd39b8ba99e44cda39dbc3858c",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/s390/pci/pci.c",
                        "arch/s390/pci/pci_bus.c",
                        "arch/s390/pci/pci_bus.h",
                        "drivers/pci/bus.c",
                        "include/linux/pci.h"
                    ],
                    "versions": [
                        {
                            "version": "5.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.104",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.21",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.2.8",
                            "lessThanOrEqual": "6.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "5.15.104"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "6.1.21"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "6.2.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "6.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/437bb839e36cc9f35adc6d2a2bf113b7a0fc9985"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a2410d0c3d2d714ed968a135dfcbed6aa3ff7027"
                },
                {
                    "url": "https://git.kernel.org/stable/c/b99ebf4b62774e690e73a551cf5fbf6f219bdd96"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ab909509850b27fd39b8ba99e44cda39dbc3858c"
                }
            ],
            "title": "PCI: s390: Fix use-after-free of PCI resources with per-function hotplug",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}