CVE-2023-53290: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53290 was disclosed on September 16, 2025, affecting the Linux kernel. The vulnerability involves a file descriptor leak in the BPF (Berkeley Packet Filter) subsystem, specifically in the samples/bpf component's runbpfprog function, where a file opened with fopen() is not properly closed, leading to a resource leak (NVD).

The vulnerability occurs in the Linux kernel's BPF subsystem where a file descriptor (fout) is opened using fopen() but not subsequently closed with fclose() in the hbm's runbpfprog function. In the affected code path, the file descriptor goes out of scope without being properly closed, resulting in a resource leak (Ubuntu).

The vulnerability affects multiple Linux distributions and versions, including Ubuntu 22.04 LTS (jammy), 20.04 LTS (focal), and various kernel packages such as linux-aws, linux-azure, and linux-gcp. Several Linux distributions have released patches to address this issue (Ubuntu).

Multiple Linux distributions have released fixes for this vulnerability. Ubuntu has released updates for affected versions: linux 5.15.0-83.92 for Ubuntu 22.04 LTS and linux 5.4.0-162.179 for Ubuntu 20.04 LTS. Users are advised to update their systems to the patched versions (Ubuntu).