Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory leak in the NXP i.MXRT1050 clock driver probe path. A local low-privilege attacker could potentially trigger availability impact, but the bundle does not show remote exposure, data theft, or active exploitation.
Executive priority
Treat as a moderate operational availability issue, not an internet-scale emergency. Prioritize affected embedded or device fleets during normal kernel maintenance, especially where local users or workloads can exercise kernel driver paths.
Technical view
The issue is CWE-401 in clk-imxrt1050. Error paths used unmanaged mappings and allocations, leaking ioremap and kzalloc resources. The fix switches to devm_of_iomap and devm_kzalloc, and adds cleanup for registered clock hardware when iomap fails.
Likely exposure
Exposure is most likely on systems running affected Linux kernel builds with the i.MXRT1050 clock driver relevant to their hardware or configuration. The source metadata identifies Linux kernel versions and stable commits, but exact branch boundaries should be validated against vendor kernels.
Exploitation context
CVSS indicates local access, low attack complexity, low privileges, no user interaction, and high availability impact. CISA KEV is false in the bundle, and no provided source claims active exploitation.
Researcher notes
Evidence is limited to the CVE record and kernel stable references. The bundle names memory-leak cleanup and availability impact, but does not provide exploit details, observed attacks, or a product-specific vendor matrix beyond Linux kernel metadata.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check distribution or device-vendor advisories for backported kernel packages.
- Prioritize embedded or industrial devices using i.MXRT1050-related kernels.
- Track vendor kernel divergence from upstream stable fixes.
Validation and detection
- Inventory kernel versions and hardware platforms using this driver.
- Compare deployed kernel source against the referenced stable commits.
- Review vendor advisories for backport confirmation.
- Confirm vulnerability scanners map custom kernels correctly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53264 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1839032251a66f2ae5a043c495532830a55d28c4CVE reference, Linux
- https://git.kernel.org/stable/c/0fbdfd2542252e4c02e8158a06b7c0c9cfd40f99CVE reference, Linux
- https://git.kernel.org/stable/c/02e54db221bb001b32f839e0149ee8d890ab9aa1CVE reference, Linux
- https://git.kernel.org/stable/c/1b280598ab3bd8a2dc8b96a12530d5b1ee7a8f4aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.