Riskcovery

CVE-2023-53406

USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()

State
Published
Severity
5.5 Medium
Published
Sep 18, 2025
Updated
May 11, 2026
Reserved
Sep 17, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • 1d50071b53f26a7b8b7d6a0e027b9e6643bb6075 to before 6236a6d2cdfb710bd8a82c4b179d0a034d0d99cbAffected
  • 1d50071b53f26a7b8b7d6a0e027b9e6643bb6075 to before 78d9586d8e728be1e360d3d0da7170c791d1d55eAffected
  • 1d50071b53f26a7b8b7d6a0e027b9e6643bb6075 to before 8d48a7887dbca22e064c20caf20ae7949019fe9bAffected
  • 1d50071b53f26a7b8b7d6a0e027b9e6643bb6075 to before 7a038a681b7df78362d9fc7013e5395a694a9d3aAffected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.100 through 5.15.*Not affected
  • 6.1.18 through 6.1.*Not affected
  • 6.2.5 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.