CVE-2023-53402: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53402 is a memory leak vulnerability in the Linux kernel's kernel/printk/index.c component, caused by improper use of debugfs_lookup() without calling dput() on the returned result. The fix replaces the call with debugfs_lookup_and_remove(), which handles memory management automatically. It was published on September 18, 2025, and affects Linux kernel versions before 5.15.100, 5.16 through 6.1.17, and 6.2 through 6.2.4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In kernel/printk/index.c, a call to debugfs_lookup() returns a dentry pointer whose reference count must be decremented via dput() after use; omitting this call causes a reference count leak, resulting in gradual memory exhaustion. The fix substitutes debugfs_lookup_and_remove(), which atomically performs the lookup, removal, and reference release. Exploitation requires local access with low privileges, as an attacker would need to repeatedly trigger the code path to accumulate leaked memory (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation leads to gradual memory exhaustion on affected Linux systems, impacting availability (CVSS availability impact: High) with no effect on confidentiality or integrity. A local attacker with low privileges could repeatedly trigger the vulnerable code path, causing progressive memory consumption that degrades system performance or leads to instability. There is no evidence of data exposure or lateral movement potential associated with this vulnerability (Red Hat Advisory).

Update the Linux kernel to a patched version: 5.15.100 or later (for the 5.15.x stable branch), 6.1.18 or later (for the 6.1.x stable branch), or 6.2.5 or later (for the 6.2.x branch). Patches are available via the upstream kernel stable tree. No configuration-based workaround is documented; upgrading to a fixed kernel version is the recommended remediation (Red Hat Bugzilla, kernel.org patch 5.15, kernel.org patch 6.1, kernel.org patch 6.2).