{
  "cveId": "CVE-2023-53349",
  "url": "https://patchblox.com/security/cve/CVE-2023-53349",
  "summary": "CVE-2023-53349 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53349, released September 17, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  media: ov2740: Fix memleak in ov2740_init_contro...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  media: ov2740: Fix memleak in ov2740_init_controls()  There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock device:  unreferenced object 0xffff8881090e19e0 (size 16):   comm \u002251-i2c-ov2740\u0022, pid 278, jiffies 4294781584 (age 23.613s)   hex dump (first 16 bytes):     00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff  ..|......uj.....   backtrace:     [\u003C000000004e9fad8f\u003E] __kmalloc_node\u002B0x44/0x1b0     [\u003C0000000039c802f4\u003E] kvmalloc_node\u002B0x34/0x180     [\u003C000000009b8b5c63\u003E] v4l2_ctrl_handler_init_class\u002B0x11d/0x180 [videodev]     [\u003C0000000038644056\u003E] ov2740_probe\u002B0x37d/0x84f [ov2740]     [\u003C0000000092489f59\u003E] i2c_device_probe\u002B0x28d/0x680     [\u003C000000001038babe\u003E] really_probe\u002B0x17c/0x3f0     [\u003C0000000098c7af1c\u003E] __driver_probe_device\u002B0xe3/0x170     [\u003C00000000e1b3dc24\u003E] device_driver_attach\u002B0x34/0x80     [\u003C000000005a04a34d\u003E] bind_store\u002B0x10b/0x1a0     [\u003C00000000ce25d4f2\u003E] drv_attr_store\u002B0x49/0x70     [\u003C000000007d9f4e9a\u003E] sysfs_kf_write\u002B0x8c/0xb0     [\u003C00000000be6cff0f\u003E] kernfs_fop_write_iter\u002B0x216/0x2e0     [\u003C0000000031ddb40a\u003E] vfs_write\u002B0x658/0x810     [\u003C0000000041beecdd\u003E] ksys_write\u002B0xd6/0x1b0     [\u003C0000000023755840\u003E] do_syscall_64\u002B0x38/0x90     [\u003C00000000b2cc2da2\u003E] entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  ov2740_init_controls() won\u0027t clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.",
  "published": "2025-09-17T15:15:38Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00202,
  "epssPercentile": 0.10206,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.20-1",
      "fix": "DEBIAN-CVE-2023-53349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53349",
      "released": "2025-09-17T15:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.20-1",
      "fix": "DEBIAN-CVE-2023-53349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53349",
      "released": "2025-09-17T15:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.20-1",
      "fix": "DEBIAN-CVE-2023-53349",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53349",
      "released": "2025-09-17T15:15:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}