CVE-2023-53396: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53396 is a memory leak vulnerability in the Linux kernel's UBIFS (Unsorted Block Image File System) subsystem, specifically in the do_rename function. When renaming a file in an encrypted directory, fscrypt_setup_filename allocates memory for a filename that is never used and never freed, resulting in a kernel memory leak (CWE-401). The vulnerability was published on September 18, 2025, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (RedHat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the do_rename code path within ubifs_rename, a call to fscrypt_setup_filename allocates a 32-byte kernel heap object for an encrypted filename; however, this allocation is unnecessary for the rename operation and the memory is never freed before the function returns. The fix removes the superfluous fscrypt_setup_filename call entirely. The vulnerability requires local access with low privileges and is triggered simply by renaming a file within an encrypted UBIFS directory, as confirmed by kmemleak output tracing the allocation through __kmalloc → fscrypt_setup_filename → do_rename → ubifs_rename → vfs_rename → do_renameat2 (RedHat Advisory, Feedly).

Successful exploitation causes a kernel memory leak on systems using UBIFS with encrypted directories. A low-privileged local attacker can repeatedly rename files in an encrypted UBIFS directory to gradually exhaust kernel memory, potentially leading to degraded system performance or a denial-of-service condition. There is no impact on confidentiality or integrity; the sole impact is on availability (RedHat Advisory, Feedly).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

Patches have been applied to multiple Linux kernel stable branches. Users should upgrade to the following fixed versions or later: 5.15.112, 5.17, 6.1.28, 6.2.15, or 6.3.2. The fix removes the unnecessary fscrypt_setup_filename call in do_rename. As a temporary workaround for systems that cannot be immediately patched, administrators should minimize local user access to encrypted UBIFS directories. Kernel updates can be verified via standard package manager tooling or by checking the running kernel version (RedHat Advisory, Feedly).