CVE-2023-53999 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: TC, Fix internal port memory leak
The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed.
The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 00 00 00 03 f0 00 00 04 00 00 00 ................ 98 77 67 41 81 88 ff ff 98 77 67 41 81 88 ff ff .wgA.....wgA.... backtrace: [<00000000e992680d>] kmalloc_trace+0x27/0x120
[<000000009e945a98>] mlx5e_tc_int_port_get+0x3f3/0xe20 [mlx5_core]
[<0000000035a537f0>] mlx5e_tc_add_fdb_flow+0x473/0xcf0 [mlx5_core]
[<0000000070c2cec6>] __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]
[<000000005cc84048>] mlx5e_configure_flower+0xd40/0x4c40 [mlx5_core]
[<000000004f8a2031>] mlx5e_rep_indr_offload.isra.0+0x10e/0x1c0 [mlx5_core]
[<000000007df797dc>] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core]
[<0000000016c15cc3>] tc_setup_cb_add+0x1cf/0x410
[<00000000a63305b4>] fl_hw_replace_filter+0x38f/0x670 [cls_flower]
[<000000008bc9e77c>] fl_change+0x1fd5/0x4430 [cls_flower]
[<00000000e7f766e4>] tc_new_tfilter+0x867/0x2010
[<00000000e101c0ef>] rtnetlink_rcv_msg+0x6fc/0x9f0
[<00000000e1111d44>] netlink_rcv_skb+0x12c/0x360
[<0000000082dd6c8b>] netlink_unicast+0x438/0x710
[<00000000fc568f70>] netlink_sendmsg+0x794/0xc50
[<0000000016e92590>] sock_sendmsg+0xc5/0x190
So fix this by moving int_port cleanup code to the flow attribute free helper, which is used by all the attribute free cases.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/25/2026
The vulnerability identified as CVE-2023-53999 resides within the Linux kernel's mlx5e network driver, specifically affecting the Traffic Control (TC) subsystem. This issue manifests as a memory leak involving internal port objects when flow rules are processed through the mlx5e driver, particularly when handling packets that traverse both internal ports and tunneling mechanisms. The root cause stems from improper reference counting mechanisms during the creation and destruction of flow rules, leading to unreferenced memory allocations that persist beyond their intended use. The vulnerability is particularly concerning in environments utilizing connection tracking (CT) with 'new' state offload capabilities, where the interaction between internal port objects and post-action rules creates a scenario where memory allocated for internal port tracking is never properly released.
The technical flaw occurs within the mlx5e driver's flow rule management system where the mlx5e_tc_int_port_get() function increments the reference count of internal port objects when they are assigned to flow attributes of post-action rules. However, the corresponding mlx5e_tc_int_port_put() function which should decrement this reference count and potentially free the object is not invoked in all code paths. This creates a scenario where internal port objects remain allocated even when no longer referenced by active flow rules, resulting in a memory leak that accumulates over time. The kernel's kmemleak subsystem detects this issue by identifying unreferenced objects that remain allocated for extended periods, as demonstrated by the specific memory address and backtrace provided in the vulnerability report.
The operational impact of this vulnerability extends beyond simple memory consumption issues, potentially leading to system instability and performance degradation in high-traffic network environments. When multiple flow rules are processed through the affected code paths, particularly in virtualized networking scenarios where internal ports and tunneling are commonly used, the memory leak can grow progressively, eventually consuming significant system resources and potentially leading to memory exhaustion. This is particularly problematic in data center and cloud environments where network virtualization and connection tracking are heavily utilized, as these scenarios are most likely to trigger the problematic code paths. The vulnerability affects systems using Mellanox ConnectX network adapters with the mlx5e driver, making it relevant to a substantial portion of enterprise and data center networking infrastructure.
The fix implemented addresses the root cause by centralizing the cleanup logic for internal port objects within the flow attribute free helper function, ensuring that all code paths that destroy flow attributes properly decrement the reference count and release the associated internal port objects. This approach aligns with standard memory management best practices and follows the principle of resource acquisition is initialization (RAII) where resource cleanup is tied to the lifecycle of the object that holds the resource. The solution ensures that regardless of how flow rules are created or split, the internal port reference counting is properly maintained and cleaned up, preventing the accumulation of unreferenced memory objects. This fix directly addresses the memory leak identified in the vulnerability report and prevents the potential for system resource exhaustion through proper reference counting and cleanup mechanisms. The mitigation approach follows established patterns for memory management in kernel space and aligns with common practices in the industry for preventing resource leaks in complex networking subsystems. This vulnerability is classified under CWE-401 as a failure to release memory and relates to ATT&CK technique T1070.004 for bypassing defenses through memory manipulation.