Cloudanix VulnDB

CVE-2023-53682

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Oct 7, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux hardware monitoring code for certain servers can waste memory over time and eventually slow down or crash the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unreleased ioremap and memremap allocations in xgene_hwmon_probe cause a memory leak when the driver loads on affected hardware.

Why it matters to the business

Repeated driver initialization on systems using the xgene hwmon driver can exhaust kernel memory, leading to degraded performance or crashes that disrupt monitoring and system stability.

How an attack unfolds

An attacker with local access loads or reloads the xgene hwmon driver to trigger the probe path repeatedly, accumulating unreleased mappings until memory pressure causes denial of service.

How to fix it

Update the Linux kernel to a version containing commit 9d482a09acd3d5f61a56aefc125d32c81994707b or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 9d482a09acd3d5f61a56aefc125d32c81994707b and confirm absence of the original ioremap/memremap calls without devm_ wrappers in drivers/hwmon/xgene-hwmon.c.

Typical attack path

  1. Obtain local user access on a system with the xgene hwmon driver present
  2. Trigger repeated module load or device probe events for the driver
  3. Accumulate leaked mappings until kernel memory is exhausted

How to detect it

Review kernel logs for repeated xgene_hwmon_probe entries and monitor memory usage patterns on systems with the driver enabled; no post-exploitation artifacts are typically left.

What your security team should do

  • Prioritize kernel upgrade on all systems using xgene hardware monitoring
  • Audit kernel configurations to disable unnecessary hwmon drivers where possible
  • Monitor for memory pressure on affected hosts until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: hwmon: (xgene) Fix ioremap and memremap leak Smatch reports: drivers/hwmon/xgene-hwmon.c:757 xgene_hwmon_probe() warn: 'ctx->pcc_comm_addr' from ioremap() not released on line: 757. This is because in drivers/hwmon/xgene-hwmon.c:701 xgene_hwmon_probe(), ioremap and memremap is not released, which may cause a leak. To fix this, ioremap and memremap is modified to devm_ioremap and devm_memremap. [groeck: Fixed formatting and subject]

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.1.25
Linux Kernel 4.9.0 6.1.25

Related vulnerabilities