{"cve":"CVE-2023-54033","nvd":{"published":"2025-12-24T11:15:56.297","modified":"2026-06-17T06:46:34.477","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix a memory leak in the LRU and LRU_PERCPU hash maps\n\nThe LRU and LRU_PERCPU maps allocate a new element on update before locking the\ntarget hash table bucket. Right after that the maps try to lock the bucket.\nIf this fails, then maps return -EBUSY to the caller without releasing the\nallocated element. This makes the element untracked: it doesn't belong to\neither of free lists, and it doesn't belong to the hash table, so can't be\nre-used; this eventually leads to the permanent -ENOMEM on LRU map updates,\nwhich is unexpected. Fix this by returning the element to the local free list\nif bucket locking fails.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1a9e80f757bbb1562d82e350afce2bb2f712cc3d","https://git.kernel.org/stable/c/79ea1a12fb9a8275b6e19d4ca625dd872dedcbb9","https://git.kernel.org/stable/c/965e9cccbe6b9c7b379908cebcb5e3a47f20dd5e","https://git.kernel.org/stable/c/b34ffb0c6d23583830f9327864b9c1f486003305"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2023-54033","score":0.00186,"percentile":0.08262,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}