CVE-2023-53221: bpf: Fix memleak due to fentry attach failure

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-15 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static $ echo $((6442453466 & 0x7fffffff)) 2522 Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned.

Affected products

Linux kernel: from 5.10.28 before 5.11; from 5.11.11 before 5.12; from 5.12.1 before 6.1.39; from 6.2 before 6.3.13; from 6.4 before 6.4.4; 5.12, 5.12-rc5, 5.12-rc6, 5.12-rc7, 5.12-rc8 — fixed in 5.11, 5.12, 6.1.39, 6.3.13, 6.4.4

How to fix

Upgrade to a fixed version: Linux kernel 5.11, 5.12, 6.1.39, 6.3.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53221 or the next vulnerability affects your stack