CVE-2023-53221
published 2025-09-15CVE-2023-53221: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
4.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init")
int fentry_run()
{
return 0;
}
It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.
$ tail /proc/kallsyms
ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
[2522] FUNC 'trap_init' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff))
2522
Note that there are two left bpf trampoline images, that is because the
libbpf will fallback to raw tracepoint if -EINVAL is returned.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 5.10.28 < 5.11 | 5.11 |
| linux | linux | >= 5.11.11 < 5.12 | 5.12 |
| linux | linux | >= e21aa341785c679dd409c8cb71f864c00fe6c463 < 20109ddd5bea2c24d790debf5d02584ef24c3f5e | 20109ddd5bea2c24d790debf5d02584ef24c3f5e |
| linux | linux | >= e21aa341785c679dd409c8cb71f864c00fe6c463 < f72c67d1a82dada7d6d504c806e111e913721a30 | f72c67d1a82dada7d6d504c806e111e913721a30 |
| linux | linux | >= e21aa341785c679dd409c8cb71f864c00fe6c463 < 6aa27775db63ba8c7c73891c7dfb71ddc230c48d | 6aa27775db63ba8c7c73891c7dfb71ddc230c48d |
| linux | linux | >= e21aa341785c679dd409c8cb71f864c00fe6c463 < 108598c39eefbedc9882273ac0df96127a629220 | 108598c39eefbedc9882273ac0df96127a629220 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 5.10.28 < 5.11 | 5.11 |
| linux | linux_kernel | >= 5.11.11 < 5.12 | 5.12 |
| linux | linux_kernel | >= 5.12.1 < 6.1.39 | 6.1.39 |
| linux | linux_kernel | >= 6.2 < 6.3.13 | 6.3.13 |
| linux | linux_kernel | >= 6.4 < 6.4.4 | 6.4.4 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2px5-v96w-8g69: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the
ghsa_unreviewed·2025-09-15
CVE-2023-53221 [MEDIUM] CWE-401 GHSA-2px5-v96w-8g69: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init")
int fentry_run()
{
return 0;
}
It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.
$ tail /proc/kallsyms
ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
[2522] FUNC 'trap_init' type_id=119 lin
OSV
CVE-2023-53221: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the al
osv·2025-09-15·CVSS 5.5
CVE-2023-53221 [MEDIUM] CVE-2023-53221: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the al
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=st
Red Hat
kernel: bpf: Fix memleak due to fentry attach failure
vendor_redhat·2025-09-15·CVSS 5.5
CVE-2023-53221 [MEDIUM] CWE-772 kernel: bpf: Fix memleak due to fentry attach failure
kernel: bpf: Fix memleak due to fentry attach failure
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init")
int fentry_run()
{
return 0;
}
It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.
$ tail /proc/kallsyms
ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'tra
Microsoft
bpf: Fix memleak due to fentry attach failure
vendor_msrc·2025-09-09·CVSS 5.5
CVE-2023-53221 [MEDIUM] CWE-401 bpf: Fix memleak due to fentry attach failure
bpf: Fix memleak due to fentry attach failure
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2023-53221: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix me...
vendor_debian·2023·CVSS 5.5
CVE-2023-53221 [MEDIUM] CVE-2023-53221: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix me...
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=st
No detection rules found.
No public exploits indexed.
2025-09-15
Published