CVE-2023-53792: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53792 is a memory leak vulnerability in the Linux kernel's NVMe core subsystem, specifically within the nvme_ctrl_dhchap_ctrl_secret_store() function. The flaw occurs when nvme_auth_generate_key() returns an error — the dhchap_secret buffer is not freed before the function returns, resulting in a kernel memory leak. It affects Linux kernel versions starting from commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea up to the patched releases in stable branches. The vulnerability was published on December 9, 2025, and is estimated as Medium severity with an EPSS score of 0.000180 (Feedly, EUVD).

The root cause is a missing memory deallocation on an error path in the NVMe DH-HMAC-CHAP (DHC) authentication secret store handler, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In nvme_ctrl_dhchap_ctrl_secret_store(), when nvme_auth_generate_key() fails, the function returns early without calling kfree() on the previously allocated dhchap_secret buffer, leaking kernel heap memory. The fix involves inserting a kfree(dhchap_secret) call on the error return path before exiting the function. Patches were applied to multiple stable kernel branches (Feedly, kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes a kernel heap memory leak in systems using NVMe DH-HMAC-CHAP authentication. Repeated triggering could gradually exhaust kernel memory, potentially degrading system performance or contributing to denial-of-service conditions over time. There is no evidence of confidentiality or integrity impact; the primary risk is availability degradation on systems with NVMe authentication enabled (Feedly, EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-53792. The EPSS score is extremely low at 0.000180, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Qualys scanner (detection ID 761056) and Tenable Nessus (plugin 278055) (Feedly).

The Linux kernel stable branches have been patched with fixes backported to versions 6.1.39, 6.3.13, 6.4.4, and 6.5. Administrators should update to these patched kernel versions or later. The specific fix commits are 43d0724d756a13694f612a8a151f835ad6425b93, 39b90fc75943406d2bd60fd1ea041aca2559cc5f, 6ec30a62789913b1bd0f0d44ea4d0d2d5608b1e8, and 99c2dcc8ffc24e210a3aa05c204d92f3ef460b05. SUSE has also issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) addressing this CVE in their kernel packages (Feedly, Linux Security SUSE).