Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory leak that can gradually consume kernel resources and cause availability problems. It requires local access and low privileges, so the main business risk is denial of service on systems where untrusted users, workloads, or tenants can run code.
Executive priority
Treat as a normal-to-elevated kernel maintenance item, not an emergency based on current evidence. Raise priority where local users or untrusted workloads share the same host, because the impact is availability rather than data theft.
Technical view
The resolved bug is in drivers/base/component debugfs handling. A debugfs_lookup() result was not released with dput(), causing a CWE-401 memory leak over time. The fix uses debugfs_lookup_and_remove(), which handles lookup and release logic together.
Likely exposure
Exposure is most relevant for Linux systems running affected kernel versions listed in the CVE source bundle, including 5.13, 5.15.100, 6.1.18, 6.2.5, and 6.3. Distro backport status is not provided.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction, and high availability impact. The source bundle says KEV is false and provides no evidence of active exploitation.
Researcher notes
Evidence supports a memory leak in debugfs component cleanup, fixed by upstream stable commits. The bundle does not identify affected distributions, practical exploitability details, or exploitation in the wild, so validation should focus on kernel lineage and vendor package status.
Mitigation direction
- Apply vendor Linux kernel updates that include the upstream stable fix.
- Prioritize shared, multi-user, CI, container-host, and tenant-exposed Linux systems.
- Check distribution advisories because vendor kernel packages may backport fixes.
- If no package fix is available, follow vendor guidance for supported kernel upgrade paths.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and container hosts.
- Map installed distro kernel packages to vendor advisory or changelog status.
- Check whether referenced upstream stable commits are included or backported.
- Confirm high-risk shared systems are patched before lower-exposure endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53409 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/09709a49283f79184c998d6dafcc01590e4d654dCVE reference, Linux
- https://git.kernel.org/stable/c/79ac2b01e033181e21cc84216ace1f4160eb8950CVE reference, Linux
- https://git.kernel.org/stable/c/bf0fd01c7cc1061fb2cfda3e2044371642108e6cCVE reference, Linux
- https://git.kernel.org/stable/c/8deb87b1e810dd558371e88ffd44339fbef27870CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.