CVE-2023-23003: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel before version 5.16, a vulnerability exists in the tools/perf/util/expr.c file where it lacks a check for the hashmap__new return value. This vulnerability was discovered and disclosed in January 2023, affecting Linux kernel systems prior to version 5.16 (MITRE CVE, Debian Tracker).

The vulnerability stems from a missing validation check in the tools/perf/util/expr.c file. Specifically, the hashmap__new() function may return ERR_PTR(-ENOMEM) when malloc() fails, but the code lacks the necessary IS_ERR() checking for ctx->ids (GitHub Commit). The vulnerability has been assigned a CVSS score of 7.8 (HIGH) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

The vulnerability has been fixed in Linux kernel version 5.16 with the addition of proper error checking for the hashmap__new return value. The fix includes adding IS_ERR() checking for ctx->ids and proper cleanup in case of allocation failure (GitHub Commit).