cbcvebase.
CVE-2023-53637
published 2025-10-07

CVE-2023-53637: In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov772x: Fix memleak in ov772x_probe() A memory leak was reported when testing…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov772x: Fix memleak in ov772x_probe() A memory leak was reported when testing ov772x with bpf mock device: AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes): 80 22 88 15 81 88 ff ff ."...... backtrace: [] __kmalloc_node+0x44/0x1b0 [] kvmalloc_node+0x34/0x180 [] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [] ov772x_probe+0x1c3/0x68c [ov772x] [] i2c_device_probe+0x28d/0x680 [] really_probe+0x17c/0x3f0 [] __driver_probe_device+0xe3/0x170 [] driver_probe_device+0x49/0x120 [] __device_attach_driver+0xf7/0x150 [] bus_for_each_drv+0x114/0x180 [] __device_attach+0x1e5/0x2d0 [] bus_probe_device+0x126/0x140 [] device_add+0x810/0x1130 [] i2c_new_client_device+0x359/0x4f0 [] of_i2c_register_device+0xf1/0x110 [] of_i2c_notify+0x100/0x160 unreferenced object 0xffff888119825c00 (size 256): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 32 bytes): 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\...... backtrace: [] __kmalloc_node+0x44/0x1b0 [] kvmalloc_node+0x34/0x180 [] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] [] v4l2_ctrl_new_std+0x16f/0x210 [videodev] [] ov772x_probe+0x1fa/0x68c [ov772x] [] i2c_device_probe+0x28d/0x680 [] really_probe+0x17c/0x3f0 [] __driver_probe_device+0xe3/0x170 [] driver_probe_device+0x49/0x120 [] __device_attach_driver+0xf7/0x150 [] bus_for_each_drv+0x114/0x180 [] __device_attach+0x1e5/0x2d0 [] bus_probe_device+0x126/0x140 [] device_add+0x810/0x1130 [] i2c_new_client_device+0x359/0x4f0 [] of_i2c_register_device+0xf1/0x110 The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() are leaked.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.20-1 (bookworm)linux 6.1.20-1 (bookworm)
linuxlinux——
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < cc3b6011d7a9f149489eb9420c6305a779162c57cc3b6011d7a9f149489eb9420c6305a779162c57
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < 448ce1cd50387b1345ec14eb191ef05f7afc2a26448ce1cd50387b1345ec14eb191ef05f7afc2a26
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < dfaafeb8e9537969e8dba75491f732478c7fa9d6dfaafeb8e9537969e8dba75491f732478c7fa9d6
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < 1da495101ef7507eb4f4b1dbec2874d740eff2511da495101ef7507eb4f4b1dbec2874d740eff251
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < ac93f8ac66e60227bed42d5a023f0e6c15b52c0aac93f8ac66e60227bed42d5a023f0e6c15b52c0a
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < c86d760c1c6855a6131e78d0ddacc48c79324ac3c86d760c1c6855a6131e78d0ddacc48c79324ac3
linuxlinux>= 1112babde21483d86ed3fbad1320b0ddf9ab2ece < 7485edb2b6ca5960205c0a49bedfd09bba30e5217485edb2b6ca5960205c0a49bedfd09bba30e521
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 4.17 < 4.19.2764.19.276
linuxlinux_kernel>= 4.20 < 5.4.2355.4.235
linuxlinux_kernel>= 5.11 < 5.15.995.15.99
linuxlinux_kernel>= 5.16 < 6.1.166.1.16
linuxlinux_kernel>= 5.5 < 5.10.1735.10.173
linuxlinux_kernel>= 6.2 < 6.2.36.2.3

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.