CVE-2023-53435
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-18

Last updated on: 2025-12-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cassini: Fix a memory leak in the error handling path of cas_init_one() cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but not it the error handling path of the probe. Add the missing vfree() to avoid a memory leak, should an error occur.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-18
Last Modified
2025-12-11
Generated
2026-06-16
AI Q&A
2025-09-18
EPSS Evaluated
2026-06-15
NVD
CVE-2023-53435
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 2.6.28 (inc) to 4.14.316 (exc)
linux linux_kernel From 4.15 (inc) to 4.19.284 (exc)
linux linux_kernel From 4.20 (inc) to 5.4.244 (exc)
linux linux_kernel From 5.5 (inc) to 5.10.181 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.113 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.30 (exc)
linux linux_kernel From 6.2 (inc) to 6.3.4 (exc)
linux linux_kernel 6.4
linux linux_kernel 6.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the Linux kernel related to the cassini driver. Specifically, in the cas_saturn_firmware_init() function, memory is allocated using vmalloc(), but if an error occurs during initialization, this memory is not freed properly because the error handling path is missing a call to vfree(). This causes a memory leak until the .remove() function is called, which normally frees the memory.

Impact Analysis

The memory leak caused by this vulnerability can lead to increased memory usage over time if errors occur during the initialization of the cassini driver. This can degrade system performance and potentially cause resource exhaustion, leading to instability or crashes in the affected Linux system.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the memory leak in the cas_init_one() error handling path has been fixed. This involves applying the patch that adds the missing vfree() call to properly free allocated memory in error cases.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart