CVE-2023-53221 bpf: Fix memleak due to fentry attach failure
A memory leak in the Linux kernel BPF subsystem allows attackers to exhaust system memory by repeatedly failing fentry attachments, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53221?
CVE-2023-53221 is a medium-severity denial of service vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init") int fentry_run() { return 0; }
It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms.
$ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff)) 2522
Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned.
Weakness: CWE-401
Which versions are affected by CVE-2023-53221?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53221?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53221 being exploited?
There is no known exploitation of CVE-2023-53221 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-71230, BELL-CVE-2023-53221, DEBIAN-CVE-2023-53221, GHSA-2px5-v96w-8g69, ROOT-OS-DEBIAN-11-CVE-2023-53221, ROOT-OS-UBUNTU-2204-CVE-2023-53221 and 1 more.