CVE-2023-52475: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52475 is a use-after-free vulnerability discovered in the Linux kernel's powermate driver. The vulnerability was identified by syzbot and disclosed on February 29, 2024. The issue affects the powermate_config_complete function in drivers/input/misc/powermate.c, impacting multiple versions of the Linux kernel from 4.14.x through 6.5.x (NVD).

The vulnerability occurs when a powermate device is disconnected, leading to a memory free operation on the powermate_device struct. The issue arises when an asynchronous control message completes after the kfree operation, and its callback is invoked, causing the lock to no longer exist. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) by NVD, with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker to crash the system at device disconnect, potentially leading to kernel information leaks. This could compromise system stability and potentially expose sensitive kernel information (Red Hat).

The vulnerability requires local access and low attack complexity to exploit. An attacker needs low privileges to trigger the vulnerability, and no user interaction is required. The vulnerability has been classified as CWE-416: Use After Free (NVD).

The vulnerability has been patched by adding usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. The fix has been implemented across multiple kernel versions through various stable releases (Kernel Patch).