CVE-2023-53743

What it actually does

The vulnerability is a memory leak in the Linux kernel PCI subsystem where release_resource() is invoked during resource coalescing but the associated resource list entry is never freed.

Why it matters to the business

Long-running systems may experience gradual kernel memory exhaustion, leading to performance degradation or crashes, particularly in environments with frequent PCI device configuration changes.

How an attack unfolds

An attacker triggers repeated PCI resource allocation and coalescing operations through driver loading, device hotplug events, or configuration changes, causing unreleased list entries to accumulate without direct code execution.

How to fix it

Update the Linux kernel to version 6.1.53 or later, or apply commit 4443f3695d581ad1a55f2ef59259dcd0c52402b3 in the stable tree to ensure the resource list entry is freed after release_resource().

How to confirm the fix worked

Verify the running kernel version is at least 6.1.53, review the PCI resource management code for the added free call after release_resource(), and monitor kernel memory statistics for PCI-related allocations.

Typical attack path

1. Obtain local or privileged access to trigger PCI resource operations
2. Repeatedly perform device insertion, driver reload, or resource reconfiguration to invoke coalescing
3. Accumulate leaked resource list entries over time
4. Induce kernel memory pressure leading to instability or denial of service

How to detect it

Review kernel logs and memory accounting for repeated PCI resource coalescing without corresponding frees; track growth in slab or vmalloc usage tied to resource lists over extended periods.

What your security team should do

• Prioritize kernel upgrades to 6.1.53 or patched stable branches on all affected systems
• Test updates in staging environments before broad deployment
• Monitor kernel memory usage trends for PCI subsystems post-update