CVE-2023-53818: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53818 is a reference count (refcount) leak vulnerability in the Linux kernel's ARM Zynq platform initialization code, specifically in the zynq_early_slcr_init function. The root cause is that of_find_compatible_node() returns a node pointer with an incremented reference count, but the code fails to call of_node_put() on error paths, resulting in a resource leak. The vulnerability affects multiple stable Linux kernel branches prior to the following patched versions: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. It was published on December 9, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, EUVD).

The vulnerability is classified as a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime). In zynq_early_slcr_init, the kernel function of_find_compatible_node() increments the reference count of the returned device tree node pointer. When an error condition is encountered and the function returns early, the code omits the required of_node_put() call to decrement the reference count, causing a refcount leak. This is a local, kernel-level issue triggered during early platform initialization on ARM Zynq hardware; it does not involve network-accessible attack surfaces. The fix adds the missing of_node_put() call on all error paths, as reflected in multiple stable kernel commits (Feedly, EUVD).

The primary impact of this vulnerability is a kernel resource (reference count) leak, which can lead to memory not being properly freed over time on affected ARM Zynq systems. In practice, this may cause gradual resource exhaustion or incorrect reference counting for device tree nodes, potentially affecting system stability. The vulnerability does not directly enable remote code execution, privilege escalation, or data exfiltration, and its real-world impact is limited to systems using ARM Zynq-based hardware running affected Linux kernel versions (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-53818. The EPSS score is extremely low at 0.000240, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus (plugin 278103) and Qualys (plugin 761056) (Feedly, Tenable).

The fix has been backported to multiple stable Linux kernel branches. Users should update to the following patched versions or later: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, or 6.3. The fix is implemented via upstream kernel commits adding the missing of_node_put() call on error paths in zynq_early_slcr_init. There are no known configuration-based workarounds; upgrading the kernel is the recommended remediation (Feedly, EUVD).