CVE-2023-53637
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Oct 7, 2025
CISA due date
—
Cloudanix analysis
A programming mistake in camera driver code can slowly use up system memory over time if certain errors happen during device setup.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Memory leak occurs in ov772x_probe() when priv->hdl.error is set, skipping v4l2_ctrl_handler_free() after v4l2_ctrl_handler_init_class and v4l2_ctrl_new_std allocations, leaving unreferenced kmalloc and kvmalloc objects.
Why it matters to the business
Gradual memory exhaustion on Linux systems using the ov772x camera driver can degrade performance or cause denial of service; ecosystem prevalence is high in kernel-dependent environments with no ransomware usage or KEV listing and stable low EPSS trend.
How an attack unfolds
An attacker loads the ov772x module via I2C device registration on a system with a mock or faulty device tree entry; probe path triggers error handling that leaks control handler resources without free, enabling repeated allocation to exhaust memory.
How to fix it
Update to fixed versions: decidim 0.26.9 or 0.27.5; apply kernel patch that ensures v4l2_ctrl_handler_free is called before error_mutex_destroy in ov772x_probe.
How to confirm the fix worked
Confirm by inspecting ov772x_probe source for v4l2_ctrl_handler_free call on error path; test with bpf mock device and verify no unreferenced objects via kmemleak or slabinfo after probe failure.
Typical attack path
- Register I2C device triggering of_i2c_register_device and i2c_new_client_device
- Invoke ov772x_probe which calls v4l2_ctrl_handler_init_class and v4l2_ctrl_new_std
- Set error condition to jump to error_mutex_destroy without handler free
- Repeat to accumulate unreferenced allocations until memory pressure occurs
How to detect it
Search kernel logs for ov772x_probe entries, I2C device addition traces, and kmemleak reports showing unreferenced v4l2_ctrl_handler allocations; correlate with python3 or probe processes in slabinfo.
- unreferenced object.*v4l2_ctrl_handler
- ov772x_probe.*error_mutex_destroy
- v4l2_ctrl_handler_init_class+0x11d
What your security team should do
- Prioritize upgrade of decidim to 0.26.9 or 0.27.5 within normal patching windows given stable EPSS and non-KEV status
- Audit kernel configurations for ov772x driver usage and disable if unused
- Monitor memory usage on camera-enabled systems for anomalous growth
The record
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov772x: Fix memleak in ov772x_probe() A memory leak was reported when testing ov772x with bpf mock device: AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes): 80 22 88 15 81 88 ff ff ."...... backtrace: [<000000009990b438>] __kmalloc_node+0x44/0x1b0 [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x] [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 [<0000000048370519>] driver_probe_device+0x49/0x120 [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 [<00000000358e5596>] __device_attach+0x1e5/0x2d0 [<0000000043f83c5d>] bus_probe_device+0x126/0x140 [<00000000ee0f3046>] device_add+0x810/0x1130 [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 [<00000000a9f2159d>] of_i2c_notify+0x100/0x160 unreferenced object 0xffff888119825c00 (size 256): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 32 bytes): 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\...... backtrace: [<000000009990b438>] __kmalloc_node+0x44/0x1b0 [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x] [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 [<0000000048370519>] driver_probe_device+0x49/0x120 [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 [<00000000358e5596>] __device_attach+0x1e5/0x2d0 [<0000000043f83c5d>] bus_probe_device+0x126/0x140 [<00000000ee0f3046>] device_add+0x810/0x1130 [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() are leaked.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 4.17.0 | 4.19.276 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-64kb | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default-base | 0 | 5.14.21-150500.55.127.1.150500.6.61.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-docs | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-obs-build | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-source | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-syms | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.127.1.150500.6.61.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_32 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.127.1.150500.6.61.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.127.1.150500.6.61.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-zfcpdump | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.127.1.150500.6.61.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.127.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.127.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel