CVE-2023-53568 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2023-53568?

CVE-2023-53568 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's s390/zcrypt driver. When dev_set_name() fails during device creation, allocated resources aren't properly freed, leading to potential memory exhaustion. This affects Linux systems running on IBM Z mainframe architecture with the zcrypt cryptographic driver enabled.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's s390/zcrypt driver. When dev_set_name() fails during device creation, allocated resources aren't properly freed, leading to potential memory exhaustion. This affects Linux systems running on IBM Z mainframe architecture with the zcrypt cryptographic driver enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not explicitly stated in CVE, but patches are available in stable kernel trees

Operating Systems: Linux distributions running on IBM Z/s390x architecture

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when zcrypt cryptographic driver is enabled and in use on IBM Z/s390x systems. Most Linux distributions are not affected unless running on this specific architecture.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could repeatedly trigger the failure condition to cause memory exhaustion, leading to system instability, denial of service, or kernel panic.

🟠

Likely Case

Memory leak gradually consumes system resources, potentially causing performance degradation or system instability over time.

🟢

If Mitigated

With proper memory monitoring and resource limits, impact is limited to potential performance issues rather than complete system failure.

🌐 Internet-Facing: LOW - This requires local access or ability to interact with the zcrypt driver, which is typically not exposed externally.

🏢 Internal Only: MEDIUM - Local users or processes with appropriate privileges could potentially exploit this to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger the specific failure condition in the zcrypt driver. No known public exploits exist.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits referenced in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/0878052579cb2773caee64812a811edcab6b5a55

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repository. 2. For custom kernels, apply the relevant patch from the stable kernel tree. 3. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Disable zcrypt driver

linux

If zcrypt cryptographic functionality is not required, disable the driver module

modprobe -r zcrypt
echo 'blacklist zcrypt' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Implement strict memory limits and monitoring for processes that could trigger the vulnerability
Restrict access to users who could potentially exploit the memory leak condition

🔍 How to Verify

Check if Vulnerable:

Check if running on s390x architecture with zcrypt module loaded: 'uname -m' should show s390x and 'lsmod | grep zcrypt' should show the module

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions from your distribution, or verify the specific commit is included in your kernel source

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
Memory allocation failures in kernel logs
System performance degradation logs

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("Out of memory" OR "oom-killer" OR "memory allocation failure")

📊 Metadata

CVE ID: CVE-2023-53568

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.02% exploit probability (5.5th percentile)

Published: October 4, 2025

Last Updated: February 6, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-53568, you might also want to check these: