CVE-2023-53174: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability was identified in the Linux kernel's SCSI core component, tracked as CVE-2023-53174. The issue occurs when device_add() fails, where the name allocated by dev_set_name() needs to be freed. This vulnerability was disclosed on September 15, 2025 (NVD).

The vulnerability stems from improper memory management in the SCSI core component of the Linux kernel. When device_add() returns an error, the system fails to properly free the name allocated by dev_set_name(). According to the documentation, put_device() should be used to decrease the reference count in the error path. The fix involves calling put_device() to ensure the name can be freed in kobject_cleanp() (NVD).

The vulnerability can result in memory leaks in the Linux kernel's SCSI subsystem, potentially leading to resource exhaustion over time. This affects various Linux distributions including Ubuntu and Oracle Linux systems (Ubuntu).

The issue has been fixed in various Linux distributions. Ubuntu has released patches for multiple versions: Ubuntu 22.04 LTS (5.15.0-91.101), Ubuntu 20.04 LTS (5.4.0-169.187), and several other kernel variants. Oracle Linux has also provided fixes for affected systems (Ubuntu).