CVE-2023-53423: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53423 is a memory leak vulnerability in the Linux kernel's objtool component, specifically within the create_static_call_sections() function. The flaw arises because memory allocated by strdup() for key_name is not released in certain error paths, violating proper memory management. It affects Linux kernel versions 5.10.x before 5.10.173, 5.11.x–5.15.x before 5.15.100, 5.16.x–6.1.x before 6.1.18, and 6.2.x before 6.2.5. The CVE was published on September 18, 2025, with CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In create_static_call_sections(), strdup() is called to allocate memory for key_name, but error paths within the function exit without calling free() on that allocation, resulting in a memory leak. The fix adds explicit free() calls in the affected error paths to ensure proper cleanup. Exploitation requires local access with low privileges, as the vulnerable code path is exercised during kernel build-time static call section processing (NVD, Feedly).

The primary impact is on availability: repeated triggering of the memory leak can cause gradual memory exhaustion, leading to system performance degradation or instability. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state. The scope is limited to the local system, with no known potential for lateral movement or data exfiltration (NVD, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Update to a patched Linux kernel version: 5.10.173 or later, 5.15.100 or later, 6.1.18 or later, or 6.2.5 or later. Patches are available via the upstream kernel stable tree at the referenced kernel.org commits (NVD). As interim measures, administrators can implement strict memory resource monitoring, limit local user access to critical system components, and schedule periodic system restarts to clear accumulated leaked memory (Feedly).