Memory Leak Vulnerability in Linux Kernel's USB Gadget for PXA25X UDC

CVE-2023-53406

What is CVE-2023-53406?

A memory leak vulnerability exists in the USB gadget implementation of the Linux kernel, specifically within the pxa25x_udc subsystem. The issue arises when the function debugfs_lookup() is called without ensuring that dput() is properly invoked, leading to gradual memory consumption. To address this vulnerability effectively, developers are advised to use debugfs_lookup_and_remove(), which simplifies the memory management by handling both operations in one call, thereby preventing memory leaks.

References