CVE-2023-53527: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53527 is a memory leak vulnerability in the Linux kernel's Thunderbolt subsystem, specifically within the tb_handle_dp_bandwidth_request() function. Memory allocated by tb_queue_dp_bandwidth_request() is not released after the request is handled, resulting in a resource leak classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The vulnerability affects Linux kernel versions 6.3 through 6.4.10 and release candidates 6.5-rc1 through 6.5-rc5. It was published on October 1, 2025, with NVD initial analysis completed January 23, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing memory deallocation in the Thunderbolt DisplayPort bandwidth request handling path (CWE-401). When tb_handle_dp_bandwidth_request() processes a request queued by tb_queue_dp_bandwidth_request(), it fails to free the allocated memory after the request is consumed, causing a kernel memory leak on each invocation. Exploitation requires local access with low privileges, as an attacker must be able to trigger repeated Thunderbolt DP bandwidth requests to accumulate leaked memory. Two upstream kernel commits address the issue: 0752bb32aed2c5dd85821195a507a1079c4835f7 and 596a5123cc782d458b057eb3837e66535cd0befa (Red Hat Bugzilla).

Successful exploitation allows a local low-privileged attacker to cause progressive kernel memory exhaustion by repeatedly triggering Thunderbolt DP bandwidth requests. This can lead to system instability, performance degradation, and eventual denial of service as available kernel memory is depleted. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

Upgrade to Linux kernel version 6.4.11 or later (for the 6.4 branch) or kernel 6.5 stable release or later, which include the upstream fixes in commits 0752bb32aed2c5dd85821195a507a1079c4835f7 and 596a5123cc782d458b057eb3837e66535cd0befa. As a compensating control, restrict local user access and limit privileges for non-administrative users to reduce the attack surface. Systems running kernel versions 6.3.x through 6.4.10 or 6.5-rc1 through 6.5-rc5 should prioritize patching (Red Hat Bugzilla).