CVE-2023-53411: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53411 is a memory leak vulnerability in the Linux kernel's Power Management Energy Model (PM: EM) subsystem, caused by improper use of debugfs_lookup() without a corresponding dput() call on the returned dentry. It affects Linux kernel versions 5.0–5.10.172, 5.11–5.15.98, 5.16–6.1.15, and 6.2–6.2.2. The CVE was published on September 18, 2025, with patches backported to stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the PM: EM subsystem, debugfs_lookup() returns a dentry with an incremented reference count; if dput() is not called on the result, the reference is never released and the associated memory leaks over time. The fix replaces the debugfs_lookup() call with debugfs_lookup_and_remove(), which atomically performs the lookup, removal, and reference release in a single operation. Exploitation requires local access with low privileges, as the attacker must be able to trigger the code path that invokes the vulnerable function (Red Hat Advisory, kernel.org patches).

Successful exploitation by a local low-privileged attacker can cause gradual kernel memory exhaustion, leading to system performance degradation and potential denial of service. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The affected scope is the local system only, with no known path for lateral movement or sensitive data exposure (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly).

Patches are available for all affected stable kernel branches: upgrade to Linux kernel 5.10.173, 5.15.99, 6.1.16, or 6.2.3 (or later). The fix is implemented by replacing debugfs_lookup() with debugfs_lookup_and_remove() in the PM: EM subsystem. For systems that cannot be patched immediately, administrators should monitor kernel memory usage, limit access to debugfs interfaces (e.g., restrict mount permissions or unmount debugfs where not needed), and implement kernel memory monitoring to detect anomalous growth (Red Hat Advisory, kernel.org patches).