CVE-2023-53757: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-53757 is a reference count leak vulnerability in the Linux kernel's irqchip/irq-mvebu-gicp driver, specifically in the mvebu_gicp_probe function. The issue arises because of_irq_find_parent() returns a node pointer with its reference count incremented, but the driver fails to call of_node_put() to release it when the pointer is no longer needed. The vulnerability affects Linux kernel versions from 4.13 up to the patched releases and was publicly disclosed on December 8, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with no confidentiality or integrity impact but high availability impact (Red Hat CVE, Feedly).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the mvebu_gicp_probe function within drivers/irqchip/irq-mvebu-gicp.c. When of_irq_find_parent() is called, it returns a device tree node pointer with an incremented reference count; the original code omits the corresponding of_node_put() call, causing a kernel object reference count to leak on every probe of the affected driver. Exploitation requires local access and low privileges, as an attacker would need to trigger repeated driver probe cycles (e.g., via device hotplug or module reload) to accumulate leaked references. The fix adds the missing of_node_put() call at all relevant exit paths in the probe function (Red Hat Bugzilla).

The primary impact is a kernel resource (reference count) leak that can lead to resource exhaustion over time, potentially causing system instability, performance degradation, or a denial-of-service condition on affected systems. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state. The scope is limited to the local system running an affected kernel with the irq-mvebu-gicp driver loaded, which is typically found on Marvell EBU SoC-based embedded or server platforms (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2023-53757 (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation is further constrained by the requirement for local access and the niche hardware (Marvell GICP-based platforms) on which the affected driver is active.

The fix has been backported and is available in the following patched Linux kernel stable releases: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3 (Red Hat CVE, Feedly). Administrators should update to the latest patched kernel version appropriate for their distribution. As a secondary measure, monitoring for unusual resource consumption or kernel memory growth on Marvell EBU SoC-based systems can help detect prolonged impact. Vendor-specific kernel packages (e.g., Red Hat Enterprise Linux) should be updated via the standard package management process once patches are available from the respective vendor (Red Hat Bugzilla).