Security readout for executives and security teams
Plain-English summary
This is a Linux kernel resource-leak flaw in the media mdp3 code. A local authenticated user could potentially consume kernel resources and cause availability impact. The public record does not show remote exploitation or active exploitation.
Executive priority
Treat this as a moderate availability risk. It is not currently supported as a remote or actively exploited issue, but it matters for shared Linux systems where local users could trigger resource exhaustion.
Technical view
The flaw is a CWE-401 resource leak: mdp3 code obtains a device object through of_find_device_by_node but did not release it with put_device. CVSS is 5.5: local attack vector, low complexity, low privileges, no user interaction, and availability-only impact.
Likely exposure
Exposure is most likely on systems running affected Linux kernel versions or downstream packages that include the vulnerable mdp3 media driver code. The source data lists Linux kernel 6.1, 6.1.55, 6.5.5, and 6.6 among affected entries, but downstream vendor status requires confirmation.
Exploitation context
No KEV listing is provided, and the source bundle contains no evidence of active exploitation. The CVSS vector indicates exploitation requires local privileges and targets availability, not confidentiality or integrity.
Researcher notes
The public description is narrow and patch-oriented. It identifies a missing put_device after of_find_device_by_node in media mdp3. Affected-version metadata appears limited and partly ambiguous, so validate against kernel commit history and downstream vendor backports.
Mitigation direction
- Update to a kernel or vendor package that includes the referenced stable fixes.
- Check Linux distribution advisories for exact patched package versions.
- Prioritize shared systems with untrusted local users or container workloads.
- Do not assume network-facing exposure without product-specific evidence.
- Track vendor guidance if running custom or embedded kernels.
Validation and detection
- Inventory running kernel versions across Linux hosts and appliances.
- Confirm whether affected builds include the mdp3 media driver code.
- Compare vendor package status against the referenced stable commits.
- Verify remediation by confirming the running kernel includes the fix.
- Document exceptions where vendor guidance is unavailable or incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53385 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8ba9d91c8f21f070af2049f114c206a8f2d5c71eCVE reference, Linux
- https://git.kernel.org/stable/c/fa481125bc4ca8edc1a4c62fe53486ac9a817593CVE reference, Linux
- https://git.kernel.org/stable/c/35ca8ce495366909b4c2e701d1356570dd40c4e2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.