CVE-2023-54273: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54273 is a resource leak vulnerability in the Linux kernel's XFRM (IPsec transform) subsystem, specifically a netdev reference tracker leak caused by an incorrect *_put() call during direction checks. The netdev reference tracker is initialized but then released using the wrong function, resulting in a memory/resource leak. It was published on December 30, 2025, and affects Linux kernel versions prior to the fixes introduced in stable commits targeting the 6.3.4 and 6.4 patch series. The CVSS base score is not formally assigned (estimated Medium by Feedly), and the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is an improper resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's xfrm subsystem. During direction validation checks, the code initializes a netdev reference tracker but subsequently calls the wrong *_put() function to release it, causing the tracker to leak rather than be properly freed. The vulnerability was introduced at commit 919e43fad516 and fixed in stable commits 7d16c515059b (one stable branch) and ec8f32ad9a65 (another stable branch). No public proof-of-concept exploit code has been identified (Feedly, Kernel Git Fix 1, Kernel Git Fix 2).

The primary impact of this vulnerability is a resource leak within the Linux kernel's XFRM/IPsec subsystem, which could lead to gradual memory exhaustion or degraded system stability over time, particularly on systems with high IPsec/XFRM traffic. There is no evidence of direct confidentiality or integrity impact; the vulnerability does not enable remote code execution or privilege escalation. The availability impact is limited to potential kernel resource exhaustion in long-running systems (Feedly, EUVD).

Apply the upstream Linux kernel patches that fix the incorrect *_put() call in the XFRM subsystem. The fixes are available in stable commits 7d16c515059b3746f2d6a24a74c3ba786a68c2a1 (targeting the 6.3.x branch) and ec8f32ad9a65a8cbb465b69e154aaec9d2fe45c4 (targeting the 6.4 branch and later). Users should update to patched kernel versions (6.3.4+ or 6.4+) as provided by their Linux distribution. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Kernel Git Fix 1, Kernel Git Fix 2).