CVE-2023-53997: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53997 is a double-free memory corruption vulnerability in the Linux kernel's thermal management subsystem (thermal: of). The flaw was introduced after commit 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure"), which changed thermal_zone_device_register() to allocate and later free a copy of the tzp argument. As a result, thermal_of_zone_register() leaks its original tzp pointer and double-frees the copied structure upon unregistration. The vulnerability was published on December 24, 2025, and affects Linux kernel versions between commit 3d439b1a2ad3 and the patched commits. No CVSS score has been formally assigned by NVD; Feedly estimates the severity as Medium with an EPSS score of 0.00018 (Feedly, CVE Record).

The root cause is a double-free memory error (CWE-415) in the Linux kernel's thermal_of_zone_register() function. After commit 3d439b1a2ad3 modified thermal_zone_device_register() to internally allocate a copy of the tzp (thermal zone parameters) structure and free it on unregistration, the calling function thermal_of_zone_register() was not updated accordingly — it continued to hold a reference to the original tzp allocation, which is now leaked, while the internally copied tzp is double-freed when the thermal zone is unregistered. The fix relocates tzp to the stack in thermal_of_zone_register(), eliminating both the memory leak and the double-free condition (kernel.org patch 1, kernel.org patch 2).

A double-free vulnerability in kernel memory management can lead to heap corruption, potentially causing system instability or crashes (denial of service). In more severe scenarios, depending on kernel version and heap layout, double-free conditions in the kernel can be leveraged for privilege escalation or arbitrary code execution in kernel context, though no such exploitation has been demonstrated for this specific issue. The vulnerability is confined to the thermal subsystem and is most likely to manifest during thermal zone unregistration on affected systems with device-tree-based thermal zone configurations (Feedly).

The fix is available in the Linux kernel stable tree via two patches: commit ac4436a5b20e0ef1f608a9ef46c08d5d142f8da6 (targeting the 6.5 stable branch) and commit adce49089412a9ae28f5c666e0bb12fbcd86b3f7 (targeting the 6.4.8 stable branch). Users should update to a patched kernel version that includes these commits. SUSE has also issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating this fix for their kernel packages (kernel.org patch 1, kernel.org patch 2, Linux Security SUSE).