CVE-2023-53468
NoneCVSS
—
EPSS
0.2%
Published
Oct 1, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's UBIFS filesystem code can leave memory allocated during failed mount attempts, slowly using up system resources over time.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Memory leak in UBIFS alloc_wbufs() when ubifs_wbuf_init() fails partway through its allocation loop, leaving previously allocated wbuf->buf and wbuf->inodes structures unfreed.
Why it matters to the business
Repeated mount operations or error conditions during filesystem initialization can gradually exhaust kernel memory, causing system instability or denial of service on affected Linux systems.
How an attack unfolds
An attacker with ability to trigger UBIFS mounts (such as via crafted images or container environments) induces allocation failures inside the wbuf initialization loop; the missing error path leaves allocated buffers resident, accumulating leaks across multiple attempts until memory pressure impacts the system.
How to fix it
Update the Linux kernel to a version containing commit 1f206002c6bc302bface871ef3f72c0bbcaa931c or later; rebuild and deploy the fixed kernel across all affected systems.
How to confirm the fix worked
Verify the running kernel contains the referenced commit; re-run kmemleak after mount stress tests to confirm no unreferenced wbuf objects remain; inspect alloc_wbufs() for the added error-handling free path.
Typical attack path
- Obtain or craft a UBIFS image that triggers allocation failure paths
- Trigger repeated mount syscalls against the image
- Monitor for gradual kernel memory growth without corresponding object release
- Continue until memory pressure causes OOM or system degradation
How to detect it
Review kernel logs for repeated UBIFS mount failures; use kmemleak or slabinfo to detect growing numbers of unreferenced UBIFS wbuf objects; correlate with high mount syscall volume from untrusted sources.
What your security team should do
- Prioritize kernel upgrades on any system using UBIFS filesystems
- Monitor memory usage during mount-heavy workloads until patched
- Add UBIFS mount operations to kernel memory-leak regression testing
The record
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in alloc_wbufs() kmemleak reported a sequence of memory leaks, and show them as following: unreferenced object 0xffff8881575f8400 (size 1024): comm "mount", pid 19625, jiffies 4297119604 (age 20.383s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa0406b2b>] ubifs_mount+0x307b/0x7170 [ubifs] [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0 [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230 [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0 [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270 [<ffffffff83c14295>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff8881798a6e00 (size 512): comm "mount", pid 19677, jiffies 4297121912 (age 37.816s) hex dump (first 32 bytes): 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace: [<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa0418342>] ubifs_wbuf_init+0x52/0x480 [ubifs] [<ffffffffa0406ca5>] ubifs_mount+0x31f5/0x7170 [ubifs] [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0 [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230 [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0 [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270 [<ffffffff83c14295>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The problem is that the ubifs_wbuf_init() returns an error in the loop which in the alloc_wbufs(), then the wbuf->buf and wbuf->inodes that were successfully alloced before are not freed. Fix it by adding error hanging path in alloc_wbufs() which frees the memory alloced before when ubifs_wbuf_init() returns an error.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 2.6.27 | 5.4.235 |
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_45 | 0 | 1-150400.9.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_31 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-source-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-source-rt | 0 | 5.14.21-150400.15.133.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.109.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.109.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-zfcpdump | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-zfcpdump | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-docs | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-obs-build | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.124.1.150500.6.59.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.124.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Proxy LTS 4.3 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-default | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.179.1.150400.24.92.1 |
| SUSE:Manager Server LTS 4.3 | kernel-source | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-syms | 0 | 5.14.21-150400.24.179.1 |
| SUSE:Manager Server LTS 4.3 | kernel-zfcpdump | 0 | 5.14.21-150400.24.179.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel