CVE-2023-53779: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-53779 is a rejected/withdrawn CVE that was originally associated with a memory leak vulnerability in the Linux kernel's mfd: dln2 driver. The issue involved a missing usb_put_dev() call in the dln2_probe() error handling path when dln2_setup_rx_urbs() fails, resulting in a reference count leak on dln2->usb_dev. The CVE was published on December 9, 2025, and subsequently rejected by its CVE Numbering Authority (Linux). Because this CVE has been officially rejected, no authoritative CVSS score is assigned; the EUVD entry lists a base score of 0.0 (Feedly).

The underlying defect (prior to CVE rejection) was classified as a memory management error (CWE-401: Missing Release of Memory after Effective Lifetime). In the dln2_probe() function within the Linux kernel's mfd/dln2.c driver, when dln2_setup_rx_urbs() returns an error, the error-handling path (out_free) failed to call usb_put_dev() to decrement the USB device reference counter, causing a resource leak. The fix, backported across multiple stable kernel branches, adds the missing usb_put_dev() call in the error path (Feedly). Because the CVE has been rejected, this issue may have been a duplicate or otherwise invalidated by the Linux CNA.

As a memory leak in a USB MFD driver's probe path, the practical security impact is limited — the leak would only occur during device initialization failure and would not directly expose sensitive data or allow privilege escalation. The primary consequence is a gradual resource exhaustion (availability impact) if the condition is repeatedly triggered, though this is constrained to systems with the DLN2 USB adapter hardware present. Given the CVE's rejected status, no formal impact rating applies.

CVE-2023-53779 has been officially rejected by its CVE Numbering Authority and carries an EPSS score of approximately 0.024% (0.000240), indicating an extremely low probability of exploitation (Feedly). There is no known public exploit code, no evidence of in-the-wild exploitation, no threat actor attribution, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The Nessus plugin 278360 references this CVE for detection purposes.

Because CVE-2023-53779 has been rejected, no formal remediation is required under this identifier. The underlying code fix (adding usb_put_dev() to the dln2_probe() error path) was backported to multiple Linux stable branches: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4 (Feedly). Users running affected kernel versions who wish to address the underlying memory leak should update to these patched stable releases.