CVE-2023-53662

What it actually does

The flaw causes memory leaks from the fscrypt_name struct's crypto_buf.name member in ext4_fname_setup_filename() and ext4_fname_prepare_lookup() when filename casefolding fails, as the buffer is not freed on the error path.

Why it matters to the business

Local attackers can trigger repeated leaks to exhaust system memory, resulting in denial of service on Linux systems using ext4 with encryption or casefolding; low EPSS and no KEV status indicate limited active exploitation risk despite 387 days since publication.

How an attack unfolds

A local attacker performs file operations involving casefolded or encrypted filenames that intentionally fail casefolding, invoking the vulnerable functions repeatedly to accumulate unfreed memory allocations without triggering any remote or privilege escalation vectors.

How to fix it

Apply the kernel fix for the memory leak in error paths; for message_bus (RubyGems) update to version 3.3.7.

How to confirm the fix worked

Confirm kernel source includes the error-path kfree calls for crypto_buf.name in both functions; test by simulating casefolding failures and monitoring for memory growth via slabinfo or kmemleak.

Typical attack path

1. Obtain local access to a system with ext4 filesystem using fscrypt or casefolding
2. Craft and trigger filename operations designed to fail casefolding
3. Invoke ext4_fname_setup_filename or ext4_fname_prepare_lookup in a loop
4. Accumulate leaked crypto_buf allocations until memory exhaustion occurs

How to detect it

Review kernel logs for repeated ext4 casefolding errors combined with unexplained memory growth; inspect fscrypt-related allocations in kmemleak reports or /proc/slabinfo for leaks after filename operations.

What your security team should do

• Prioritize patching affected Linux kernels to resolve the leak
• Monitor memory usage on ext4 filesystems with encryption enabled
• Review any downstream message_bus deployments for the 3.3.7 update