CVE-2023-25012

The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.

• CWE-416
• CWE-416

• http://www.openwall.com/lists/oss-security/2023/02/02/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/11/05/1
• https://bugzilla.suse.com/show_bug.cgi?id=1207560
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2
• https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
• https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it/
• https://seclists.org/oss-sec/2023/q1/53Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/02/02/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/11/05/1
• https://bugzilla.suse.com/show_bug.cgi?id=1207560
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2
• https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
• https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it/
• https://seclists.org/oss-sec/2023/q1/53Exploit, Mailing List, Third Party Advisory

Published

Feb 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25007A malicious actor may convince a user to open a malicious US…7.8
• CVE-2023-25008A malicious actor may convince a user to open a malicious US…7.8
• CVE-2023-25009A malicious actor may convince a user to open a malicious US…7.8
• CVE-2023-2501Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-25010A malicious actor may convince a victim to open a malicious …7.8
• CVE-2023-25011PC settings tool Ver10.1.26.0 and earlier, PC settings tool …7.8
• CVE-2023-25013An issue was discovered in the femanager extension before 5.…7.5
• CVE-2023-25014An issue was discovered in the femanager extension before 5.…7.5
• CVE-2023-25015Clockwork Web before 0.1.2, when Rails before 5.2 is used, a…6.5
• CVE-2023-25016Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x b…7.5
• CVE-2023-25017RIFARTEK IOT Wall has a vulnerability of incorrect authoriza…8.1
• CVE-2023-25018RIFARTEK IOT Wall transportation function has insufficient f…5.4