LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52445: media: pvrusb2: fix use after free on context disconnection

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-52445 is a Linux kernel bug in the pvrusb2 media driver. A race during device or context disconnection can leave code reading freed memory. The public sources describe a syzbot-reported invalid read and stable kernel fixes, but do not show active exploitation or a public exploit.

Executive priority

Treat this as routine-to-priority kernel patching, not an emergency, unless affected systems expose USB device interaction or use the pvrusb2 driver. No active exploitation is supported by the provided sources.

Technical view

The bug is a use-after-free in the Linux kernel pvrusb2 driver. A kthread may destroy and free a context before the USB hub event path notifies the driver, creating an invalid read during disconnection handling. Stable commits add a sanity check in the disconnection path.

Likely exposure

Exposure is most likely on Linux systems running affected kernels where the pvrusb2 media driver is present or loaded. Systems without this driver in use are less likely to be exposed. The source bundle does not define exact runtime prerequisites or attacker access requirements.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle. The sources mention syzbot detection, not real-world exploitation. Because this is kernel memory-safety behavior, impact could matter, but the public evidence only confirms an invalid read/use-after-free condition.

Researcher notes

Key uncertainty is exploitability beyond the syzbot invalid-read report. The CVE text describes the race and fix, but provides no CVSS, CWE, proof of exploitation, or affected distribution package matrix beyond referenced stable commits and Debian advisories.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable pvrusb2 fix.
  • Prioritize hosts that load pvrusb2 or allow USB media device attachment.
  • For Debian LTS systems, review the listed Debian kernel advisories.
  • If updates are unavailable, check vendor guidance for disabling unused media drivers.
  • Keep kernel packages aligned with supported distribution security channels.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Check whether the pvrusb2 module is present or loaded.
  • Confirm installed kernels include the referenced stable fix or later vendor backport.
  • Review distribution advisories for package-specific fixed versions.
  • Verify USB/media-driver exposure on shared, kiosk, lab, or physical-access systems.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52445 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308unaffected
LinuxLinux2.6.26, 0, 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.