CVE-2023-53518

What it actually does

A memory leak occurs in devfreq_dev_release() because srcu_init_notifier_head() allocates resources without a corresponding srcu_cleanup_notifier_head() call, as reported by kmemleak.

Why it matters to the business

Gradual memory exhaustion on Linux systems using device frequency scaling can lead to performance degradation or instability over long runtimes; high prevalence across Debian releases and kernel trees increases exposure but low EPSS and absence from KEV or ransomware campaigns limits urgency.

How an attack unfolds

An attacker with local access triggers repeated devfreq device release operations to accumulate unreleased notifier resources and exhaust memory; no public exploits or named threat actors are associated with this specific issue despite mentions of unrelated campaigns.

How to fix it

Upgrade affected linux packages to fixed versions including Debian 5.10.46-1 or kernel commit 7462483446cb9986568ad7adae746ce5f18d2968; apply updates promptly given 394 days since publication.

How to confirm the fix worked

Confirm kernel version matches or exceeds the listed fixed releases; enable and inspect kmemleak output for devfreq-related leaks after device operations.

Typical attack path

1. Obtain local access on an affected Linux kernel
2. Trigger repeated devfreq device attach/release cycles
3. Accumulate leaked SRCU notifier resources until memory pressure occurs

How to detect it

Inspect kmemleak reports for unreleased srcu notifier heads tied to devfreq; review kernel logs for devfreq_dev_release activity and correlate with memory growth patterns.

What your security team should do

• Apply kernel updates to all affected Debian and stable trees immediately
• Run kmemleak scans on representative systems to validate absence of leaks
• Monitor memory usage trends on production workloads using devfreq