CVE-2023-53276Missing Release of Memory after Effective Lifetime in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 97.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 16

Description

In the Linux kernel, the following vulnerability has been resolved: ubifs: Free memory for tmpfile name When opening a ubifs tmpfile on an encrypted directory, function fscrypt_setup_filename allocates memory for the name that is to be stored in the directory entry, but after the name has been copied to the directory entry inode, the memory is not freed. When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'tmpfile' just opening

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

NVDlinux/linux_kernel4.154.19.283+7
Debianlinux/linux_kernel< 5.10.191-1+3
CVEListV5linux/linuxf4f61d2cc6d8789a52245a4733b3e5643be154f38ad8c67a897e68426e85990ebfe0a7d1f71fc79f+9
debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

🔴Vulnerability Details

2
OSV
CVE-2023-53276: In the Linux kernel, the following vulnerability has been resolved: ubifs: Free memory for tmpfile name When opening a ubifs tmpfile on an encrypted d2025-09-16
GHSA
GHSA-jfrm-9rr7-r45w: In the Linux kernel, the following vulnerability has been resolved: ubifs: Free memory for tmpfile name When opening a ubifs tmpfile on an encrypted2025-09-16

📋Vendor Advisories

2
Red Hat
kernel: Kernel: Denial of Service via ubifs memory leak2025-09-16
Debian
CVE-2023-53276: linux - In the Linux kernel, the following vulnerability has been resolved: ubifs: Free...2023
CVE-2023-53276 — Linux vulnerability | cvebase