LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53449: s390/dasd: Fix potential memleak in dasd_eckd_init()

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential memleak in dasd_eckd_init() `dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it also needs to be freed before the error returns, just like the other cases in this function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory leak in IBM Z/s390 storage initialization code. It appears relevant mainly to systems using DASD ECKD storage support, not ordinary Linux servers. The public record gives no CVSS score and does not cite real-world exploitation, so urgency depends on whether those workloads exist in your environment.

Executive priority

Treat as a targeted platform maintenance item, not a broad emergency. Patch during the next appropriate kernel maintenance window for exposed s390 DASD environments, unless vendor guidance raises severity.

Technical view

Sources describe a Linux kernel s390 DASD ECKD init error path memory leak: dasd_reserve_req is allocated before dasd_vol_info_req and was not freed before some error returns. The fix frees it consistently. Affected records include Linux kernel versions around 5.3 through stable fixed releases listed in the CVE data; no CVSS or CWE is supplied.

Likely exposure

Exposure is most likely on Linux systems running on s390 architecture with DASD ECKD storage support and affected kernel builds. The source bundle does not support treating all Linux deployments as exposed.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no source cites active exploitation. The issue is described as a potential memory leak during initialization error handling, with no public exploitability details provided.

Researcher notes

Evidence is limited to the CVE description and kernel stable commit references. No CVSS, CWE, exploit status, crash impact, or attacker preconditions are provided. Avoid overstating risk without vendor or maintainer detail.

Mitigation direction

  • Update affected Linux kernels to vendor builds containing the referenced stable fixes.
  • Check Linux distribution advisories for backported fixes and supported package versions.
  • Prioritize s390 systems using DASD ECKD storage paths.
  • Monitor the CVE record for any later severity or exploitation updates.

Validation and detection

  • Inventory Linux systems running on s390 or IBM Z platforms.
  • Identify whether DASD ECKD storage support is present or used.
  • Verify kernel versions against vendor advisories or the listed stable commits.
  • Confirm the CVE remains absent from KEV before using low urgency assumptions.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53449 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9e12e54c7a8f616190beffb0f7ce778a86aec175, 9e12e54c7a8f616190beffb0f7ce778a86aec175, 9e12e54c7a8f616190beffb0f7ce778a86aec175, 9e12e54c7a8f616190beffb0f7ce778a86aec175, 9e12e54c7a8f616190beffb0f7ce778a86aec175, 9e12e54c7a8f616190beffb0f7ce778a86aec175unaffected
LinuxLinux5.3, 0, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.