CVE-2023-53278

published 2025-09-16

CVE-2023-53278: In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in ubifs_sysfs_init() When insmod ubifs.ko, a kmemleak reported as…

Priority P4 17 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Fix memory leak in ubifs_sysfs_init()

When insmod ubifs.ko, a kmemleak reported as below:

unreferenced object 0xffff88817fb1a780 (size 8):
comm "insmod", pid 25265, jiffies 4295239702 (age 100.130s)
hex dump (first 8 bytes):
75 62 69 66 73 00 ff ff ubifs...
backtrace:
[] slab_post_alloc_hook+0x9c/0x3c0
[] __kmalloc_track_caller+0x183/0x410
[] kstrdup+0x3a/0x80
[] kstrdup_const+0x66/0x80
[] kvasprintf_const+0x155/0x190
[] kobject_set_name_vargs+0x5b/0x150
[] kobject_set_name+0xbb/0xf0
[] do_one_initcall+0x14c/0x5a0
[] do_init_module+0x1f0/0x660
[] load_module+0x6d7e/0x7590
[] __do_sys_finit_module+0x19f/0x230
[] __x64_sys_finit_module+0x73/0xb0
[] do_syscall_64+0x35/0x80
[] entry_SYSCALL_64_after_hwframe+0x63/0xcd

When kset_register() failed, we should call kset_put to cleanup it.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.20-1 (bookworm)	linux 6.1.20-1 (bookworm)
linux	linux	—	—
linux	linux	>= 2e3cbf425804fb44a005e252f88f93dff108c911 < 1c5fdf2d4647219d2267ccb08c7f2c7095bf3450	1c5fdf2d4647219d2267ccb08c7f2c7095bf3450
linux	linux	>= 2e3cbf425804fb44a005e252f88f93dff108c911 < d42c2b18c42da7378e67b6414aafe93b65de89d1	d42c2b18c42da7378e67b6414aafe93b65de89d1
linux	linux	>= 2e3cbf425804fb44a005e252f88f93dff108c911 < 203a55f04f66eea1a1ca7e5a302a7f5c99c62327	203a55f04f66eea1a1ca7e5a302a7f5c99c62327
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 5.17 < 6.1.18	6.1.18
linux	linux_kernel	>= 6.2 < 6.2.5	6.2.5

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401