Vulnerability in Linux

CVE-2023-53415

In the Linux kernel, the following vulnerability has been resolved: USB: dwc3: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Note, the root dentry for the debugfs directory for the device needs to be saved so we don't have to keep looking it up, which required a bit more refactoring to properly create and remove it when needed.

EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

  • Linux — versions 4.19.196, 3bef21035888dd19750ad79b5d08fe52a02ad719, 8d396bb0a5b62b326f6be7594d8bd46b088296bd
  • Linux Linux_kernel

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-53415?
CVE-2023-53415 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2025-09-18.
How severe is CVE-2023-53415?
Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2023-53415 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.