CVE-2023-53999: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53999 is a memory leak vulnerability in the Linux kernel's mlx5e network driver, specifically in the Traffic Control (TC) subsystem. The flaw occurs when flow rules are split and extra post-action rules are added to the post-action table, causing an internal port (int_port) object's reference count to be incremented via mlx5e_tc_int_port_get() but never decremented because mlx5e_tc_int_port_put() is not called. This results in the int_port object never being freed, leading to a kernel memory leak. The vulnerability was published on December 24, 2025, and has an estimated CVSS severity of Medium (Feedly, CVE.org).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's net/mlx5e TC (Traffic Control) code path. When a flow rule forwards packets from an internal port over a tunnel — for example, when Connection Tracking (CT) 'new' state offload is enabled — the rule is split and post-action rules are created. The int_port object is assigned to the flow attribute of the post-action rule and its reference count is incremented by mlx5e_tc_int_port_get(), but the corresponding mlx5e_tc_int_port_put() is never invoked on cleanup, leaving the object permanently allocated. The kmemleak subsystem reports the leak originating from kmalloc_trace via mlx5e_tc_int_port_get, mlx5e_tc_add_fdb_flow, __mlx5e_add_fdb_flow, and mlx5e_configure_flower (Feedly). Fixes are referenced in kernel stable commits ac5da544a3c2 and bc1918bac0f3 (kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes a kernel memory leak in systems running the mlx5e driver with TC offload and internal port/tunnel forwarding enabled. Over time, repeated triggering can exhaust kernel memory, potentially degrading system performance or causing denial of service. There is no evidence of confidentiality or integrity impact; the primary risk is availability through memory exhaustion on affected network appliances or servers using Mellanox/NVIDIA ConnectX NICs (Feedly).

Apply the upstream Linux kernel patches referenced in commits ac5da544a3c2047cbfd715acd9cec8380d7fe5c6 and bc1918bac0f30e3f551ef5649b53062917db55fa, which add the missing mlx5e_tc_int_port_put() call to properly decrement the reference count and free the int_port object. SUSE has issued kernel security advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating this fix (Linux Security SUSE advisory 1, Linux Security SUSE advisory 2). As a workaround, disabling TC offload for internal port/tunnel forwarding rules on affected mlx5e devices can prevent the leak until a patched kernel is deployed.