CVE-2023-53261

published 2025-09-15

CVE-2023-53261: In the Linux kernel, the following vulnerability has been resolved: coresight: Fix memory leak in acpi_buffer->pointer There are memory leaks reported by…

Priority P4 18 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

coresight: Fix memory leak in acpi_buffer->pointer

There are memory leaks reported by kmemleak:
...
unreferenced object 0xffff00213c141000 (size 1024):
comm "systemd-udevd", pid 2123, jiffies 4294909467 (age 6062.160s)
hex dump (first 32 bytes):
04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff ...........] __kmem_cache_alloc_node+0x2f8/0x348
[] __kmalloc+0x58/0x108
[] acpi_os_allocate+0x2c/0x68
[] acpi_ut_initialize_buffer+0x54/0xe0
[] acpi_evaluate_object+0x388/0x438
[] acpi_evaluate_object_typed+0xe8/0x240
[] coresight_get_platform_data+0x1b4/0x988 [coresight]
...

The ACPI buffer memory (buf.pointer) should be freed. But the buffer
is also used after returning from acpi_get_dsd_graph().
Move the temporary variables buf to acpi_coresight_parse_graph(),
and free it before the function return to prevent memory leak.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.5.3-1 (forky)	linux 6.5.3-1 (forky)
linux	linux	—	—
linux	linux	>= 76ffa5ab5b79c250b9744b7f8bdd835db426a1ae < d1b60e7c9fee34eaedf1fc4e0471f75b33f83a4a	d1b60e7c9fee34eaedf1fc4e0471f75b33f83a4a
linux	linux	>= 76ffa5ab5b79c250b9744b7f8bdd835db426a1ae < 1a9e02673e2550f5612099e64e8761f0c8fc0f50	1a9e02673e2550f5612099e64e8761f0c8fc0f50
linux	linux_kernel	>= 0 < 6.5.3-1	6.5.3-1
linux	linux_kernel	>= 0 < 6.5.3-1	6.5.3-1
linux	linux_kernel	>= 5.3 < 6.5.3	6.5.3
msrc	cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401 CWE-772