CVE-2023-53370: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53370 is a memory leak vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu), specifically within the MES (Monolithic Engine Scheduler) self-test routine. The fences associated with the MES queue are not properly freed during amdgpu_ring_fini, resulting in unreleased memory. It affects Linux kernel versions from 4.2 up to (excluding) 6.1.47, and from 6.2 up to (excluding) 6.4.12. The vulnerability was published on September 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During the MES self-test in the amdgpu driver, fence objects allocated for the MES queue are not released when amdgpu_ring_fini is called, causing a kernel memory leak. Exploitation requires local access with low privileges (no user interaction needed), making it a local availability-impacting flaw rather than a remotely exploitable one. Three upstream kernel patches address the issue across the affected stable branches (Red Hat Bugzilla).

Successful exploitation leads to gradual memory exhaustion in the kernel, potentially causing system instability or denial-of-service conditions on systems with AMD GPU hardware that exercise the MES self-test path. There is no confidentiality or integrity impact — only availability is affected. Systems running frequent GPU operations or those that repeatedly initialize/finalize AMD GPU rings are most at risk of resource exhaustion over time (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2023-53370. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Update the Linux kernel to version 6.1.47 or later (for the 6.1.x stable branch), or 6.4.12 or later (for the 6.4.x stable branch), which include the upstream fixes. Three patch commits address the issue: 31d7c3a4fc3d, 8d8c96efcec9, and ce3288d8d654 on kernel.org stable trees. As a workaround on unpatched systems, restricting local user access to AMD GPU hardware and monitoring system memory usage can reduce risk. Prioritize patching on systems with AMD GPU hardware that run workloads involving frequent GPU ring initialization (Red Hat Bugzilla).