LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53746: s390/vfio-ap: fix memory leak in vfio_ap device driver

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory leak in the s390 vfio-ap device driver. When a matrix device is released, the driver looks in the wrong place for the object to free, so memory is not released. Business impact appears limited to systems using this specialized s390 AP virtualization path, but severity is not scored in the provided sources.

Executive priority

Treat as targeted kernel hygiene, not an emergency, unless critical production s390 virtualization systems use vfio-ap. Patch through the normal kernel maintenance process and verify affected assets are identified.

Technical view

The release callback retrieves vfio_matrix_dev with dev_get_drvdata(), but the object was not stored as driver data. kfree(NULL) succeeds without freeing the real allocation, leaking vfio_matrix_dev. The fix uses container_of because the released device is embedded in vfio_matrix_dev. Stable kernel commit references are provided for remediation tracking.

Likely exposure

Exposure is likely narrow: Linux systems on s390/s390x using the vfio-ap device driver and affected kernel versions or commits. General Linux servers not using this architecture and driver path are unlikely to be affected based on the provided evidence.

Exploitation context

The source bundle does not show active exploitation, KEV listing, public exploit details, or a CVSS score. The described impact is a memory leak, which may create availability risk if the vulnerable release path can be repeatedly reached, but triggerability is not established here.

Researcher notes

The key technical point is incorrect object ownership retrieval during device release. Evidence supports a memory leak, but not exploitability, privilege requirements, reachability, or real-world abuse. Validation should focus on commit presence and vfio-ap deployment context.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Prioritize s390/s390x hosts using vfio-ap or AP virtualization features.
  • Use vendor kernel guidance for packaged distribution fixes and backports.
  • If immediate patching is unavailable, reduce reliance on vfio-ap where operationally feasible.

Validation and detection

  • Inventory Linux s390/s390x systems and confirm vfio-ap driver usage.
  • Compare running kernel versions against the affected versions in the CVE record.
  • Check whether the referenced stable commits or vendor backports are present.
  • Confirm no unsupported custom kernel omits the vfio-ap memory leak fix.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53746 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1fde573413b549d52183382e639c1d6ce88f5959, 1fde573413b549d52183382e639c1d6ce88f5959, 1fde573413b549d52183382e639c1d6ce88f5959, 1fde573413b549d52183382e639c1d6ce88f5959, 1fde573413b549d52183382e639c1d6ce88f5959, 1fde573413b549d52183382e639c1d6ce88f5959unaffected
LinuxLinux4.20, 0, 5.4.240, 5.10.177, 5.15.106, 6.1.23, 6.2.10, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.