{"cve":"CVE-2023-53308","nvd":{"published":"2025-09-16T17:15:36.597","modified":"2026-06-17T06:44:48.560","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: Better handle pm_runtime_get() failing in .remove()\n\nIn the (unlikely) event that pm_runtime_get() (disguised as\npm_runtime_resume_and_get()) fails, the remove callback returned an\nerror early. The problem with this is that the driver core ignores the\nerror value and continues removing the device. This results in a\nresource leak. Worse the devm allocated resources are freed and so if a\ncallback of the driver is called later the register mapping is already\ngone which probably results in a crash.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-415"],"references":["https://git.kernel.org/stable/c/83996d317b1deddc85006376082e8886f55aa709","https://git.kernel.org/stable/c/9407454a9b18bbeff216e8ecde87ffb2171e9ccf","https://git.kernel.org/stable/c/b22b514209ff8c4287abb853399890ab97e1b5ca","https://git.kernel.org/stable/c/be85912c36ddca3e8b2eef1b5392cd8db6bdb730","https://git.kernel.org/stable/c/c1bc2870f14e526a01897e14c747a0a0ca125231"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2023-53308","score":0.00168,"percentile":0.06137,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}