CVE-2023-53353 accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()
A memory leak in the Habanalabs accelerator driver can lead to resource exhaustion and denial of service when file descriptors are released while buffers are still in use.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53353?
CVE-2023-53353 is a medium-severity denial of service vulnerability in Linux kernel, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()
The memory manager IDR is currently destroyed when user releases the file descriptor. However, at this point the user context might be still held, and memory buffers might be still in use. Later on, calls to release those buffers will fail due to not finding their handles in the IDR, leading to a memory leak. To avoid this leak, split the IDR destruction from the memory manager fini, and postpone it to hpriv_release() when there is no user context and no buffers are used.
Weakness: CWE-401
Which versions are affected by CVE-2023-53353?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53353?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53353 being exploited?
There is no known exploitation of CVE-2023-53353 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-71906, BELL-CVE-2023-53353, DEBIAN-CVE-2023-53353, GHSA-6pw4-v52h-38vj, ROOT-OS-DEBIAN-11-CVE-2023-53353, ROOT-OS-DEBIAN-12-CVE-2023-53353 and 2 more.