{"cve":"CVE-2023-52664","nvd":{"published":"2024-05-17T14:15:08.807","modified":"2026-08-04T10:18:36.933","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: eliminate double free in error handling logic\n\nDriver has a logic leak in ring data allocation/free,\nwhere aq_ring_free could be called multiple times on same ring,\nif system is under stress and got memory allocation error.\n\nRing pointer was used as an indicator of failure, but this is\nnot correct since only ring data is allocated/deallocated.\nRing itself is an array member.\n\nChanging ring allocation functions to return error code directly.\nThis simplifies error handling and eliminates aq_ring_free\non higher layer.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-415"],"references":["https://git.kernel.org/stable/c/0edb3ae8bfa31cd544b0c195bdec00e036002b5d","https://git.kernel.org/stable/c/b3cb7a830a24527877b0bc900b9bd74a96aea928","https://git.kernel.org/stable/c/c11a870a73a3bc4cc7df6dd877a45b181795fcbf","https://git.kernel.org/stable/c/d1fde4a7e1dcc4d49cce285107a7a43c3030878d","https://git.kernel.org/stable/c/0edb3ae8bfa31cd544b0c195bdec00e036002b5d"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:50:30.954589733+00:00"},"epss":{"cve":"CVE-2023-52664","score":0.00275,"percentile":0.19958,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}