CVE-2023-53999
Memory Leak in Linux Kernel mlx5e TC Internal Port Handling
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mlx5 | mlx5_core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's mlx5e driver related to internal port handling in traffic control (TC). Specifically, when flow rules are split and extra post-action rules are added, the internal port object's reference count is incremented but never decremented, causing the internal port memory to never be freed. This happens when packets are forwarded from an internal port over a tunnel, for example, when connection tracking 'new' state offload is allowed. The issue was fixed by moving the internal port cleanup code to the flow attribute free helper, ensuring proper memory release.
How can this vulnerability impact me? :
This vulnerability can cause a memory leak in the Linux kernel, which may lead to increased memory usage over time and potentially degrade system performance or stability. If the memory leak is severe, it could exhaust system memory resources, causing crashes or denial of service conditions on affected systems using the mlx5e driver for network traffic control.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kmemleak reports for unreferenced objects related to the mlx5e driver, specifically looking for memory leaks involving internal port objects. The kmemleak output includes details such as the process name (e.g., "handler20"), PID, and backtrace involving mlx5_core functions. To detect this, you can enable kmemleak in the Linux kernel and check its reports. Commands to enable and check kmemleak include: 1. Enable kmemleak (if not already enabled): echo scan > /sys/kernel/debug/kmemleak 2. Check kmemleak report: cat /sys/kernel/debug/kmemleak Look for entries similar to the reported unreferenced object with backtrace involving mlx5_core functions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix where the internal port cleanup code is moved to the flow attribute free helper, ensuring proper decrement of reference counts and preventing memory leaks. Until the patch is applied, monitor kmemleak reports to detect memory leaks and consider limiting or disabling features that trigger the vulnerability, such as CT 'new' state offload in the mlx5e driver, if possible.