CVE-2023-53844: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53844 is a resource leak vulnerability in the Linux kernel's DRM/TTM (Translation Table Manager) subsystem. Specifically, when a buffer object (BO) move to system memory fails during a swapout operation, the kernel fails to free the associated resource, resulting in a memory leak. The vulnerability was published on December 9, 2025, and affects Linux kernel versions prior to the fixes introduced in stable releases 5.15.121, 6.1.40, 6.4.5, and 6.5 (Red Hat CVE, ENISA EUVD). The CVSS score has not been formally assigned; Feedly estimates the severity as Medium, and the EPSS score is approximately 0.018% (Feedly).

The root cause is a missing resource cleanup path in the drm/ttm subsystem of the Linux kernel (CWE-401: Missing Release of Memory after Effective Lifetime). When the kernel attempts to move a buffer object to system memory as part of a GPU memory swapout operation and that move fails, the code path does not properly release the allocated TTM resource, causing a kernel memory leak. The fix was applied across multiple stable branches via commits af4e0ce2, f037f603, 4a5b37ea, and a590f03d (Kernel Git). Exploitation requires local access and the ability to trigger GPU memory swapout conditions, making this primarily a local availability/stability issue rather than a remote attack surface.

The primary impact of CVE-2023-53844 is a kernel memory leak, which can degrade system stability and availability over time as unreleased TTM resources accumulate. In systems with heavy GPU workloads or frequent memory pressure events, repeated triggering of the faulty code path could exhaust kernel memory resources, potentially leading to system instability or denial of service. There is no known confidentiality or integrity impact, and no evidence of lateral movement potential associated with this vulnerability (Red Hat CVE).

The vulnerability is fixed in the following Linux kernel stable releases: 5.15.121, 6.1.40, 6.4.5, and 6.5. Administrators should update their Linux kernel to one of these patched versions or later. The specific upstream fixes are available in kernel commits af4e0ce2, f037f603, 4a5b37ea, and a590f03d (Kernel Git). SUSE has also issued kernel security updates addressing this CVE (Linux Security SUSE). No configuration-based workarounds are known; upgrading the kernel is the recommended remediation.