CVE-2023-53995: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53995 is a memory leak vulnerability in the Linux kernel's IPv4 networking subsystem, specifically in the __inet_del_ifa() function. The flaw causes a secondary IP address to be lost when a primary address is deleted under specific conditions with promote_secondaries enabled, resulting in leaked memory for the secondary address structure as well as leaked references to in_device and net_device. It affects Linux kernel versions from 2.6.15 up to the patched stable releases (5.4.257, 5.10.195, 5.15.132, 6.1.54, 6.5.4, and 6.6). The CVE was published on December 24, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Feedly).

The root cause is a logic error (CWE not formally assigned by NVD) in __inet_del_ifa() within the Linux kernel's IPv4 address management code. When a primary IP address is deleted and promote_secondaries is enabled, the function incorrectly identifies last_prim — the last primary address before the deleted one — causing the secondary address promotion to insert the promoted address at the wrong location. As a result, the secondary address is silently dropped from the interface's address list, its memory is never freed, and the reference counts on in_device and net_device are never decremented, triggering the kernel warning unregister_netdevice: waiting for bond0 to become free. Usage count = 2. Exploitation requires local access with privileges sufficient to manipulate network interface addresses (e.g., CAP_NET_ADMIN). The fix corrects the last_prim search to start from the position of the deleted IP and inserts the promoted address at the correct location (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation leads to a kernel memory leak (the secondary in_ifaddr structure is never freed), reference count leaks on in_device and net_device objects, and ultimately prevents the network device from being cleanly unregistered. This can result in a denial-of-service condition where the kernel hangs waiting for the device reference count to reach zero, degrading system availability. Confidentiality and integrity impacts are rated High by Red Hat's CVSS assessment, though the primary practical risk is resource exhaustion and system instability rather than direct data exposure (Red Hat Advisory, Feedly).

The Linux kernel stable trees have been patched across multiple long-term support branches. Administrators should update to the following patched versions or later: 5.4.257, 5.10.195, 5.15.132, 6.1.54, 6.5.4, or 6.6. Distribution-specific kernel updates are available from vendors such as Red Hat and SUSE. As a temporary workaround, disabling promote_secondaries (sysctl -w net.ipv4.conf.<iface>.promote_secondaries=0) on affected interfaces can prevent the vulnerable code path from being triggered (Red Hat Advisory, Red Hat Bugzilla).