CVE-2023-53479: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the Linux kernel's CXL driver, specifically in the cxlparsecfmws() function (CVE-2023-53479). The vulnerability was identified on October 1, 2025, affecting the CXL ACPI implementation. This issue occurs in the cxldecoderadd() fail path where a device pointer is accessed after being released (NVD).

The vulnerability manifests when put_device() is called, releasing the cxld pointer, which is subsequently accessed. KASAN and KFENCE detected this use-after-free condition at drivers/cxl/acpi.c:299. The issue has been assigned a CVSS v3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity local attack vector requiring low privileges (RedHat).

The vulnerability could potentially lead to privilege escalation, information disclosure, or system crashes due to the use-after-free condition in the kernel's CXL driver. The high CVSS score indicates potential for significant impact if successfully exploited (RedHat).

The fix involves modifying the code to use local variables in the dev_err() function instead of pointing to the released memory. Additionally, the fix changes the open coded print format to use the %pr format specifier for printing resources (NVD).