CVE-2023-53999: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53999 is a memory leak vulnerability in the Linux kernel's mlx5e network driver, specifically in the Traffic Control (TC) subsystem. The flaw occurs when flow rules are split and extra post-action rules are added to the post-action table, causing an internal port (int_port) object's reference count to be incremented via mlx5e_tc_int_port_get() but never decremented because mlx5e_tc_int_port_put() is not called. This results in the int_port object never being freed, leading to a kernel memory leak. The vulnerability was published on December 24, 2025, and has an estimated CVSS severity of Medium (Feedly, CVE.org).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's net/mlx5e TC (Traffic Control) code path. When a flow rule forwards packets from an internal port over a tunnel — for example, when Connection Tracking (CT) 'new' state offload is enabled — the rule is split and post-action rules are created. The int_port object is assigned to the flow attribute of the post-action rule and its reference count is incremented by mlx5e_tc_int_port_get(), but the corresponding mlx5e_tc_int_port_put() is never invoked on cleanup, leaving the object permanently allocated. The kmemleak subsystem reports the leak originating from kmalloc_trace via mlx5e_tc_int_port_get, mlx5e_tc_add_fdb_flow, __mlx5e_add_fdb_flow, and mlx5e_configure_flower (Feedly). Fixes are referenced in kernel stable commits ac5da544a3c2 and bc1918bac0f3 (kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes a kernel memory leak in systems running the mlx5e driver with TC offload and internal port/tunnel forwarding enabled. Over time, repeated triggering can exhaust kernel memory, potentially degrading system performance or causing denial of service. There is no evidence of confidentiality or integrity impact; the primary risk is availability through memory exhaustion on affected network appliances or servers using Mellanox/NVIDIA ConnectX NICs (Feedly).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2023-53999. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access or the ability to configure TC flow rules with internal port and tunnel forwarding, limiting the practical attack surface (Feedly).

Apply the upstream Linux kernel patches referenced in commits ac5da544a3c2047cbfd715acd9cec8380d7fe5c6 and bc1918bac0f30e3f551ef5649b53062917db55fa, which add the missing mlx5e_tc_int_port_put() call to properly decrement the reference count and free the int_port object. SUSE has issued kernel security advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating this fix (Linux Security SUSE advisory 1, Linux Security SUSE advisory 2). As a workaround, disabling TC offload for internal port/tunnel forwarding rules on affected mlx5e devices can prevent the leak until a patched kernel is deployed.