Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-safety flaw in PCIe power-management handling. A local user with sufficient privileges could trigger a use-after-free after PCI function removal and later ASPM policy changes. The CVSS score is high, but the source bundle does not show internet exposure or confirmed exploitation.
Executive priority
Schedule remediation in the next kernel patch cycle, faster for shared servers, developer workstations, and systems with many local users. No source confirms active exploitation, but kernel use-after-free issues can carry high business impact if reachable.
Technical view
The bug is CWE-416 in PCIe ASPM state management. When function 0 of a multi-function PCI device was removed, pcie_link_state->downstream could retain a freed pci_dev pointer. Later ASPM policy changes dereferenced it. Stable fixes disable ASPM and free pcie_link_state when any child function is removed.
Likely exposure
Exposure is limited to Linux systems running affected kernels where a local user or service can influence PCIe function removal and ASPM policy changes. Cloud guests may be less exposed unless such controls are available. Confirm against distribution backports, not only upstream version numbers.
Exploitation context
The source bundle lists KEV as false and provides no evidence of active exploitation. The described trigger is local and requires privileges according to the CVSS vector. Treat this as a serious local kernel hardening issue, not as a confirmed remote attack path.
Researcher notes
The provided evidence supports a local PCIe ASPM use-after-free with high CVSS impact. It does not prove practical privilege escalation, affected distribution packages, or exploit availability. Validation should focus on kernel lineage, stable backports, and whether the PCIe management path is reachable locally.
Mitigation direction
- Apply vendor kernel updates that include the referenced stable fixes.
- Prioritize multi-user Linux systems and hosts exposing PCIe management controls.
- Check distribution advisories before assuming upstream version numbers are decisive.
- Restrict unnecessary local access to PCIe device management interfaces.
- Follow Linux kernel or vendor guidance if no packaged fix is available.
Validation and detection
- Inventory running kernel versions across Linux assets.
- Compare vendor kernel changelogs against the referenced stable commits.
- Confirm affected systems are not relying on unfixed upstream ranges.
- Review whether local users or services can manage PCIe devices or ASPM policy.
- Track remediation through normal kernel patch verification and reboot evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53446 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/666e7f9d60cee23077ea3e6331f6f8a19f7ea03fCVE reference, Linux
- https://git.kernel.org/stable/c/7badf4d6f49a358a01ab072bbff88d3ee886c33bCVE reference, Linux
- https://git.kernel.org/stable/c/9856c0de49052174ab474113f4ba40c02aaee086CVE reference, Linux
- https://git.kernel.org/stable/c/7aecdd47910c51707696e8b0e045b9f88bd4230fCVE reference, Linux
- https://git.kernel.org/stable/c/d51d2eeae4ce54d542909c4d9d07bf371a78592cCVE reference, Linux
- https://git.kernel.org/stable/c/4203722d51afe3d239e03f15cc73efdf023a7103CVE reference, Linux
- https://git.kernel.org/stable/c/456d8aa37d0f56fc9e985e812496e861dcd6f2f2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.