LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53758: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()

In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() An early error exit in atmel_qspi_remove() doesn't prevent the device unbind. So this results in an spi controller with an unbound parent and unmapped register space (because devm_ioremap_resource() is undone). So using the remaining spi controller probably results in an oops. Instead unregister the controller unconditionally and only skip hardware access and clk disable. Also add a warning about resume failing and return zero unconditionally. The latter has the only effect to suppress a less helpful error message by the spi core.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects a hardware-specific SPI controller driver. If device removal hits a failed runtime resume path, cleanup can be incomplete, leaving a controller pointing at unmapped resources. Later use could crash the kernel. Evidence points to reliability and denial-of-service risk, not data theft or remote compromise.

Executive priority

Treat this as targeted infrastructure hygiene for affected embedded Linux estates. Patch during normal maintenance unless the organization depends on Atmel QuadSPI systems with frequent driver reload, device unbind, or unstable power-management behavior.

Technical view

CVE-2023-53758 is in the atmel-quadspi driver remove path. An early return from atmel_qspi_remove() after runtime resume failure did not stop device unbind, while devm-managed register mappings were already released. The fix unregisters the SPI controller unconditionally and skips only hardware access and clock disable when resume fails.

Likely exposure

Exposure is most likely on Linux systems using the Atmel QuadSPI controller driver, commonly embedded or board-support kernels. Generic servers and endpoints are unlikely to be exposed unless this driver and hardware path are present.

Exploitation context

The bundle does not show CISA KEV listing, active exploitation, CVSS, or public exploit evidence. The described impact is a probable kernel oops after a specific remove/unbind error path, so exploitation appears local and configuration-dependent based on available evidence.

Researcher notes

The source evidence is limited to the kernel fix description and stable commit references. No CWE, CVSS, affected distribution mapping, or exploitability detail is provided. The strongest supported impact is kernel crash risk from stale SPI controller state after failed runtime resume during removal.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable commits.
  • For vendor kernels, confirm the fix is backported by the distributor or BSP maintainer.
  • Prioritize embedded systems using Atmel QuadSPI hardware or the atmel-quadspi driver.
  • If no update is available, monitor vendor guidance for supported remediation.

Validation and detection

  • Check whether the running kernel includes the atmel-quadspi driver and matching hardware.
  • Compare the kernel version or vendor changelog against the referenced stable fixes.
  • Review system logs for atmel_qspi_remove(), runtime resume failures, or kernel oops events.
  • Confirm patched systems unregister the SPI controller cleanly during device removal tests.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53758 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4a2f83b7f78092a6d9e98fb5573d8f4b79c56336, 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336, 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336, 4a2f83b7f78092a6d9e98fb5573d8f4b79c56336unaffected
LinuxLinux6.0, 0, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.