CVE-2023-53290: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53290 is a memory leak (file descriptor leak) vulnerability in the Linux kernel's samples/bpf component, specifically in the run_bpf_prog function of the Host Bandwidth Manager (HBM) BPF sample. The flaw occurs because a file pointer (fout) is opened via fopen() but never subsequently closed with fclose() before going out of scope in an affected code branch. It affects Linux kernel versions 5.1 through 6.3 across multiple stable series, with fixed versions at 5.4.244, 5.10.181, 5.15.113, 6.1.30, and 6.3.4. The vulnerability was disclosed on September 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) — specifically a file handle resource leak rather than a heap memory leak. In the run_bpf_prog function within samples/bpf/hbm.c, a FILE *fout handle is opened with fopen() in a code path that subsequently exits the function scope without calling fclose(), leaving the file descriptor unreleased. Exploitation requires local access with low privileges, as an attacker would need to repeatedly invoke the affected BPF sample program to accumulate leaked file descriptors. No public proof-of-concept exploit code has been identified (Red Hat Advisory, Kernel Patch).

Successful exploitation could lead to resource exhaustion on the affected Linux system, as repeated triggering of the leak depletes available file descriptors. This primarily affects system availability — degrading performance or causing instability — with no confidentiality or integrity impact. The scope is limited to the local system, and there is no known potential for lateral movement or data exposure (Feedly, Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2023-53290. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term (Feedly). Exploitation requires low-privilege local access, further limiting the practical attack surface.

Update the Linux kernel to a patched stable release: 5.4.244 or later, 5.10.181 or later, 5.15.113 or later, 6.1.30 or later, or 6.3.4 or later. Upstream kernel patches are available via the stable kernel tree (Kernel Patch). As a compensating control, restrict local system access to minimize the number of users who can invoke BPF sample programs, and monitor system file descriptor usage for anomalous exhaustion (Red Hat Advisory).