CVE-2023-53743: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53743 is a memory/resource leak vulnerability in the Linux kernel's PCI subsystem, specifically in the resource management code path involving release_resource(). The function does not actually free the resource or resource list entry after coalescing, leading to a kernel resource leak that can result in denial of service. It affects Linux kernel versions prior to the fixes introduced in 6.1.53, 6.4.16, 6.5.3, and 6.6. The vulnerability was published on December 8, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing kfree() call after release_resource() in the Linux kernel's PCI resource coalescing logic, classified as a memory leak (CWE-401). When PCI resources are released and coalesced, the resource list entry is removed from the list via release_resource() but the allocated memory for that entry is never freed, causing a kernel heap leak. Exploitation requires local access with low privileges, as an attacker would need to repeatedly trigger PCI resource release operations to accumulate leaked memory. No public proof-of-concept exploit code has been identified (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation by a local low-privileged attacker could cause progressive resource exhaustion in the kernel's memory allocator, leading to system performance degradation or a denial-of-service condition. The vulnerability has no confidentiality or integrity impact; the sole concern is availability, as repeated triggering of the leak could destabilize the system or cause it to become unresponsive. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Detection plugins are available via Nessus (plugin 277782) and Qualys (plugin 761056) (Red Hat Advisory, Tenable Nessus).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.1.53, 6.4.16, 6.5.3, and 6.6. Administrators should update to a patched kernel version as the primary remediation. As a secondary measure, applying least-privilege access controls to minimize local attack surfaces and monitoring system memory utilization for unexpected growth can reduce risk. Vendor-specific patches are tracked via Red Hat Bugzilla and SUSE advisories (Red Hat Bugzilla, Red Hat Advisory).