CVE-2023-53200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53200 is a memory leak vulnerability in the Linux kernel's netfilter x_tables subsystem. It occurs during the creation of a new network namespace (netns), where a per-CPU counter block allocated via xt_percpu_counter_alloc is not freed when xt_register_table subsequently fails, leaving the memory unreleased. Affected kernel versions include 4.2 through 5.15.99, 5.16 through 6.1.17, and 6.2 through 6.2.4. The vulnerability was published on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During network namespace initialization, ip6t_register_table calls translate_table, which allocates a per-CPU counter block via __alloc_percpu → xt_percpu_counter_alloc → find_check_entry. If the subsequent call to xt_register_table fails (returning ENOMEM), the error path does not invoke xt_percpu_counter_free, causing the allocated block to leak. The fix requires calling xt_percpu_counter_free on the error path, consistent with how cleanup is handled in do_replace via the cleanup_entry helper and in __ip6t_unregister_table. The probability of triggering this path is acknowledged as low, since it requires a specific sequence of allocation successes followed by a final ENOMEM in xt_register_table (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a gradual kernel memory leak within the networking subsystem, with no impact on confidentiality or integrity. Over time, repeated creation of network namespaces under memory pressure could lead to resource exhaustion, potentially degrading system availability or causing instability in long-running systems. The attack vector is local and requires low privileges, limiting the scope to systems where unprivileged users can create network namespaces (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2023-53200. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The error path that triggers the leak is inherently difficult to reach under normal operating conditions (Red Hat Advisory).

Patches are available for all affected kernel branches: upgrade to kernel 5.15.100 (for versions 4.2–5.15.99), 6.1.18 (for versions 5.16–6.1.17), or 6.2.5 (for versions 6.2–6.2.4). Upstream fixes are available in the stable kernel tree. As a workaround, administrators should minimize the creation of new network namespaces in untrusted or resource-constrained environments and monitor kernel memory usage for gradual leaks. Kernel live patching solutions may be considered for environments where reboots are disruptive (Red Hat Bugzilla, Kernel Patch 5.15, Kernel Patch 6.1).