CVE-2023-53174: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53174 is a memory leak vulnerability in the Linux kernel's SCSI core subsystem. It occurs when device_add() fails and the memory allocated by dev_set_name() is not properly freed due to missing put_device() call in the error path. The vulnerability affects Linux kernel versions from 2.6.26 through multiple stable branches up to 6.4.x, with specific fixed versions including 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, and 6.5. It was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the Linux kernel's SCSI core, when device_add() returns an error, the device name string allocated by dev_set_name() is not freed because the code fails to call put_device() to decrement the reference count. The fix involves calling put_device() in the error path, which triggers kobject_cleanup() to properly release the allocated name. Exploitation requires local access with low privileges and the ability to trigger repeated device_add() failures in the SCSI subsystem (Red Hat CVE).

The primary impact is on system availability. A local attacker with low-privilege access could repeatedly trigger the error condition to cause gradual memory exhaustion, potentially leading to system instability or a denial-of-service condition. There is no confidentiality or integrity impact associated with this vulnerability (Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Red Hat CVE).

Update to a patched Linux kernel version: 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, or 6.5. Patches are available via the upstream kernel stable tree and through distribution channels including SUSE and Amazon Linux. As a compensating control, restrict local system access to trusted users and monitor system memory usage for unexpected growth (Red Hat CVE, Red Hat Bugzilla).