---
id: CVE-2023-53174
title: 'scsi: core: Fix possible memory leak if device_add() fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: core: Fix possible memory leak if device_add() fails

  If device_add() returns error, the name allocated by dev_set_name() needs
  be freed. As the comment of device…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    63956ad27a6882f01fea7c69e17823090f4c7b3f
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    06c5340858011aa1195aec43a776e3185fbf7f56
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    e12fac07f61caac9c5b186d827658b3470787619
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    aa9a76d5ffdecd3b52ac333eb89361b0c9fe04e8
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    6bc7f4c8c27d526f968788b8a985896755b1df35
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    b191ff1f075c4875f11271cbf0093e6e044a12aa
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    43c0e16d0c5ec59398b405f4c4aa5a076e656c3f
  - >-
    Linux >= ee959b00c335d7780136c5abda37809191fe52c3 <
    04b5b5cb0136ce970333a9c6cec7e46adba1ea3a
  - Linux 2.6.26
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:19:35.995674Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:06.225Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53174'
references:
  - url: 'https://git.kernel.org/stable/c/63956ad27a6882f01fea7c69e17823090f4c7b3f'
  - url: 'https://git.kernel.org/stable/c/06c5340858011aa1195aec43a776e3185fbf7f56'
  - url: 'https://git.kernel.org/stable/c/e12fac07f61caac9c5b186d827658b3470787619'
  - url: 'https://git.kernel.org/stable/c/aa9a76d5ffdecd3b52ac333eb89361b0c9fe04e8'
  - url: 'https://git.kernel.org/stable/c/6bc7f4c8c27d526f968788b8a985896755b1df35'
  - url: 'https://git.kernel.org/stable/c/b191ff1f075c4875f11271cbf0093e6e044a12aa'
  - url: 'https://git.kernel.org/stable/c/43c0e16d0c5ec59398b405f4c4aa5a076e656c3f'
  - url: 'https://git.kernel.org/stable/c/04b5b5cb0136ce970333a9c6cec7e46adba1ea3a'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05158
ingestedAt: '2026-11-05T22:38:31.783Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix possible memory leak if device_add() fails

If device_add() returns error, the name allocated by dev_set_name() needs
be freed. As the comment of device_add() says, put_device() should be used
to decrease the reference count in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanp().

## Affected

- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < 63956ad27a6882f01fea7c69e17823090f4c7b3f`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < 06c5340858011aa1195aec43a776e3185fbf7f56`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < e12fac07f61caac9c5b186d827658b3470787619`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < aa9a76d5ffdecd3b52ac333eb89361b0c9fe04e8`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < 6bc7f4c8c27d526f968788b8a985896755b1df35`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < b191ff1f075c4875f11271cbf0093e6e044a12aa`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < 43c0e16d0c5ec59398b405f4c4aa5a076e656c3f`
- `Linux >= ee959b00c335d7780136c5abda37809191fe52c3 < 04b5b5cb0136ce970333a9c6cec7e46adba1ea3a`
- `Linux 2.6.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.