CVE-2023-52902

What it actually does

Memory leak of preallocated maple tree nodes when do_mmap() takes the error_just_free path on nommu kernels.

Why it matters to the business

Gradual kernel memory exhaustion on embedded or resource-constrained Linux systems without an MMU can degrade performance and eventually cause instability or crashes; prevalence in Android and stable kernels increases exposure across device fleets.

How an attack unfolds

An attacker triggers repeated mmap calls that intentionally hit the error path after maple tree node preallocation, causing the nodes to be leaked instead of freed; no named threat actors or ransomware campaigns are associated.

How to fix it

Apply the fix from commit 1442d51026c58e7c11dd5f9b19650632a48676d4 in the Linux stable tree; for Android packages update to versions released 2021-08-01 or later (8.1, 9, 10, 11).

How to confirm the fix worked

Confirm kernel sources contain the referenced commit or boot a patched kernel and verify no maple-tree node leaks under error-path mmap workloads; review memory statistics for nommu configurations.

Typical attack path

1. Identify systems running vulnerable nommu kernels
2. Obtain local execution or control of a process that can call mmap
3. Craft mmap requests that force the error_just_free path after node preallocation
4. Repeat to accumulate leaked kernel memory
5. Observe system degradation or OOM conditions

How to detect it

Review kernel logs and dmesg for repeated mmap error paths; track kernel memory counters and slab usage over time on nommu devices; no specific named threat actor indicators are available.

What your security team should do

• Prioritize patching nommu-based embedded and Android devices given the 785 days since publication
• Inventory all affected Linux kernel versions and Android packages
• Test the fix in representative nommu environments before broad rollout
• Monitor memory usage trends on deployed systems until upgrades complete