LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53814: PCI: Fix dropping valid root bus resources with .end = zero

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xc3a34e00 (size 64): comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) hex dump (first 32 bytes): b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<fe3aa979>] __kmalloc+0xf0/0x140 [<34bd6bc0>] resource_list_create_entry+0x18/0x38 [<767046bc>] pci_add_resource_offset+0x20/0x68 [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 When coalescing two resources for a contiguous aperture, the second resource is enlarged to cover the full contiguous range, while the first resource is marked invalid. This invalidation is done by clearing the flags, start, and end members. When adding the initial resources to the bus later, invalid resources are skipped. Unfortunately, the check for an invalid resource considers only the end member, causing false positives. E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no longer registered with pci_bus_insert_busn_res() (causing the memory leak), nor printed: pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 pci-rcar-gen2 ee090000.pci: PCI: revision 11 pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 -pci_bus 0000:00: root bus resource [bus 00] pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] Fix this by only skipping resources where all of the flags, start, and end members are zero.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause valid PCI root bus resources to be discarded during boot. The described impact is incorrect PCI resource registration and a suspected memory leak on a specific Renesas r8a7791/koelsch system. No source provided indicates remote exploitation, privilege escalation, or active attacks.

Executive priority

Treat as routine kernel maintenance unless affected embedded systems show PCI initialization problems. There is no sourced evidence of active exploitation or high-impact security consequence, but appliances should still receive vendor kernel updates.

Technical view

The PCI resource coalescing path invalidated one resource by zeroing flags, start, and end, but later skipped resources based only on end == 0. Valid resources with .end = 0 could be dropped, preventing pci_bus_insert_busn_res() registration and triggering the reported kmemleak symptom.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds with PCI host bridge resource layouts where a valid root bus resource has .end = 0. Embedded or board-specific deployments are more plausible than general server exposure, but distribution backports must be checked.

Exploitation context

The bundle marks KEV as false and provides no evidence of public exploitation. The cited kernel description frames this as a correctness and memory leak bug observed during boot, not as a demonstrated attacker-triggered path.

Researcher notes

The key condition is an invalid-resource test that used only the end member. The fix changes skip logic to require flags, start, and end all be zero. The bundle lacks CVSS, CWE, affected distribution mapping, and exploitability analysis.

Mitigation direction

  • Apply the relevant Linux stable kernel fix through the operating system or device vendor.
  • Check vendor advisories before assuming upstream version numbers map directly to deployed packages.
  • Prioritize affected embedded or appliance fleets using PCI host bridge code paths.
  • Plan normal reboot validation after kernel update installation.

Validation and detection

  • Inventory running kernel versions and vendor patch levels across Linux assets.
  • Confirm whether deployed kernels include one of the referenced stable fixes.
  • Review boot logs for missing PCI root bus resource registration symptoms.
  • On test systems, check vendor-supported diagnostics for the reported kmemleak symptom.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfd168b7d1d7cfc61cea561b1e3cc47aefc9e8f19, 7c3855c423b17f6ca211858afb0cef20569914c7, 7c3855c423b17f6ca211858afb0cef20569914c7, 7c3855c423b17f6ca211858afb0cef20569914c7unaffected
LinuxLinux5.16, 0, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.