Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2023-53501: Linux kernel may leak memory during device unbind
CVE-2023-53501 · published 1 year ago
Summary
The Linux kernel versions used in several distributions could leave memory unreclaimed when a device is disconnected. This happens because a counter that tracks usage can be reduced to zero, triggering a warning and preventing proper cleanup. Updating to the latest kernel packages resolves the issue and ensures memory is released correctly.
What to do
- Update canonical linux-xilinx-zynqmp to version 5.15.0-1027.31.
- Update canonical linux-bluefield to version 5.15.0-1035.37.
- Update canonical linux-aws-fips to version 5.15.0-1053.58+fips1.
- Update canonical linux-fips to version 5.15.0-94.104+fips1.
- Update canonical linux-gcp-fips to version 5.15.0-1055.63+fips2.
- Update canonical linux-intel-iot-realtime to version 5.15.0-1046.48.
- Update canonical linux-realtime to version 5.15.0-1054.60.
- Update canonical linux-aws-5.15 to version 5.15.0-1053.58~20.04.1.
- Update canonical linux-azure-5.15 to version 5.15.0-1056.64~20.04.1.
- Update canonical linux-gcp-5.15 to version 5.15.0-1051.59~20.04.1.
- Update canonical linux-hwe-5.15 to version 5.15.0-94.104~20.04.1.
- Update canonical linux-ibm-5.15 to version 5.15.0-1046.49~20.04.1.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1048.54~20.04.1.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-94.104~20.04.1.
- Update canonical linux-nvidia-tegra-5.15 to version 5.15.0-1022.22~20.04.1.
- Update canonical linux-oracle-5.15 to version 5.15.0-1051.57~20.04.1.
- Update canonical linux-riscv-5.15 to version 5.15.0-1049.53~20.04.2.
- Update canonical linux to version 5.15.0-94.104.
- Update canonical linux-aws to version 5.15.0-1053.58.
- Update canonical linux-azure to version 5.15.0-1056.64.
- Update canonical linux-gcp to version 5.15.0-1051.59.
- Update canonical linux-gke to version 5.15.0-1050.55.
- Update canonical linux-gkeop to version 5.15.0-1036.42.
- Update canonical linux-ibm to version 5.15.0-1046.49.
- Update canonical linux-intel-iotg to version 5.15.0-1047.53.
- Update canonical linux-kvm to version 5.15.0-1050.55.
- Update canonical linux-lowlatency to version 5.15.0-94.104.
- Update canonical linux-nvidia to version 5.15.0-1044.44.
- Update canonical linux-nvidia-tegra to version 5.15.0-1022.22.
- Update canonical linux-nvidia-tegra-igx to version 5.15.0-1009.9.
- Update canonical linux-oracle to version 5.15.0-1051.57.
- Update canonical linux-raspi to version 5.15.0-1046.49.
- Update debian linux to version 6.1.55-1.
- Update debian linux to version 6.5.3-1.
- Update canonical linux-azure-fde to version 5.15.0-1056.64.1.
- Update linux kernel to version 6.5.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.15, < 5.15.132 >= 5.16, < 6.1.53 >= 6.2, < 6.4.16 >= 6.5, < 6.5.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-xilinx-zynqmp |
< 5.15.0-1027.31 Fix: upgrade to 5.15.0-1027.31
|
| Ubuntu:Nvidia-BlueField:22.04:LTS | canonical | linux-bluefield |
< 5.15.0-1035.37 Fix: upgrade to 5.15.0-1035.37
|
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-aws-fips |
< 5.15.0-1053.58+fips1 Fix: upgrade to 5.15.0-1053.58+fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-fips |
< 5.15.0-94.104+fips1 Fix: upgrade to 5.15.0-94.104+fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-gcp-fips |
< 5.15.0-1055.63+fips2 Fix: upgrade to 5.15.0-1055.63+fips2
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-intel-iot-realtime |
< 5.15.0-1046.48 Fix: upgrade to 5.15.0-1046.48
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1054.60 Fix: upgrade to 5.15.0-1054.60
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-intel | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1053.58~20.04.1 Fix: upgrade to 5.15.0-1053.58~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1056.64~20.04.1 Fix: upgrade to 5.15.0-1056.64~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1051.59~20.04.1 Fix: upgrade to 5.15.0-1051.59~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-94.104~20.04.1 Fix: upgrade to 5.15.0-94.104~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-ibm-5.15 |
< 5.15.0-1046.49~20.04.1 Fix: upgrade to 5.15.0-1046.49~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1048.54~20.04.1 Fix: upgrade to 5.15.0-1048.54~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-94.104~20.04.1 Fix: upgrade to 5.15.0-94.104~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-nvidia-tegra-5.15 |
< 5.15.0-1022.22~20.04.1 Fix: upgrade to 5.15.0-1022.22~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1051.57~20.04.1 Fix: upgrade to 5.15.0-1051.57~20.04.1
|
Showing 50 of 130. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1049.53~20.04.2 Fix: upgrade to 5.15.0-1049.53~20.04.2
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-94.104 Fix: upgrade to 5.15.0-94.104
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1053.58 Fix: upgrade to 5.15.0-1053.58
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1056.64 Fix: upgrade to 5.15.0-1056.64
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde |
< 5.15.0-1056.64.1 Fix: upgrade to 5.15.0-1056.64.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1051.59 Fix: upgrade to 5.15.0-1051.59
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1050.55 Fix: upgrade to 5.15.0-1050.55
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1036.42 Fix: upgrade to 5.15.0-1036.42
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1046.49 Fix: upgrade to 5.15.0-1046.49
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1047.53 Fix: upgrade to 5.15.0-1047.53
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1050.55 Fix: upgrade to 5.15.0-1050.55
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-94.104 Fix: upgrade to 5.15.0-94.104
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia |
< 5.15.0-1044.44 Fix: upgrade to 5.15.0-1044.44
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra |
< 5.15.0-1022.22 Fix: upgrade to 5.15.0-1022.22
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx |
< 5.15.0-1009.9 Fix: upgrade to 5.15.0-1009.9
|
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1051.57 Fix: upgrade to 5.15.0-1051.57
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1046.49 Fix: upgrade to 5.15.0-1046.49
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Debian:12 | debian | linux |
< 6.1.55-1 Fix: upgrade to 6.1.55-1
|
| Debian:13 | debian | linux |
< 6.5.3-1 Fix: upgrade to 6.5.3-1
|
| Linux | linux | kernel |
>= 6.5.0, < 6.5.3 Fix: upgrade to 6.5.3
|
Original advisory text
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind
In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind When unbinding pasid - a race condition exists vs outstanding page faults. To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory") Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.
References
- https://git.kernel.org/stable/c/13ed255248dfbbb7f23f9170c7a537fb9ca22c73 Third Party Advisory
- https://git.kernel.org/stable/c/534103bcd52ca9c1fecbc70e717b4a538dc4ded8 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53501... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-53501 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://ubuntu.com/security/CVE-2023-53501 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-53501 Third Party Advisory
- https://git.kernel.org/linus/534103bcd52ca9c1fecbc70e717b4a538dc4ded8 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-53501 Vendor Advisory
- https://git.kernel.org/stable/c/a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22 Third Party Advisory
- https://git.kernel.org/stable/c/98d86bf32187db27946ca817c2467a5f2f7aa02f Third Party Advisory
- https://git.kernel.org/stable/c/9ccc51be3126b25cfe9351dbffde946c925cc28a Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.8
Medium
Timeline
Published1 Oct 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2023-53501 · NVD
CVE-2023-53501 · OSV
UBUNTU-CVE-2023-53501 · OSV
DEBIAN-CVE-2023-53501 · OSV
Track software like this
Free during beta