LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53555: mm/damon/core: initialize damo_filter->list from damos_new_filter()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: initialize damo_filter->list from damos_new_filter() damos_new_filter() is not initializing the list field of newly allocated filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not initializing it after calling damos_new_filter(). As a result, accessing uninitialized memory is possible. Actually, adding multiple DAMOS filters via DAMON sysfs interface caused NULL pointer dereferencing. Initialize the field just after the allocation from damos_new_filter().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53555 is a Linux kernel DAMON memory-management bug. A newly created DAMOS filter was not fully initialized, which could cause uninitialized memory access. The public record specifically notes NULL pointer dereferencing when multiple DAMOS filters are added through the DAMON sysfs interface.

Executive priority

Treat as a kernel stability risk with incomplete severity data. Prioritize normal kernel patching, escalating where DAMON is enabled on production systems or where unplanned kernel crashes would materially affect services.

Technical view

damos_new_filter() failed to initialize damo_filter->list. DAMON sysfs and DAMON_RECLAIM did not initialize that field after allocation, so later list operations could touch uninitialized state. The fix initializes the list field immediately after filter allocation.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or commits where DAMON sysfs or DAMON_RECLAIM paths are present and used. The bundle lists Linux kernel 6.3 through 6.5-era versions, but distro-specific exposure requires vendor mapping.

Exploitation context

The provided sources do not show active exploitation, KEV listing, public exploit code, or remote attack evidence. The described observed failure is NULL pointer dereference after adding multiple DAMOS filters through DAMON sysfs.

Researcher notes

The public bundle identifies the root cause and stable fix commits but does not provide CVSS, CWE, privilege requirements, or distro package status. Avoid assuming remote reachability or active exploitation without additional vendor or KEV evidence.

Mitigation direction

  • Check whether running kernels include the referenced stable fixes.
  • Apply vendor kernel updates that include the DAMON filter initialization fix.
  • Prioritize systems where DAMON sysfs or DAMON_RECLAIM is enabled or operationally used.
  • Track distribution advisories for exact package names and fixed versions.

Validation and detection

  • Inventory Linux kernel versions and compare against vendor fixed releases.
  • Review kernel configuration and runtime use of DAMON sysfs and DAMON_RECLAIM.
  • Confirm patched source contains damo_filter->list initialization in damos_new_filter().
  • Check vendor advisories for backported fixes on supported distributions.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53555 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux98def236f63c66629fb6b2d4b69cecffc5b46539, 98def236f63c66629fb6b2d4b69cecffc5b46539unaffected
LinuxLinux6.3, 0, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.