CVE-2023-54009: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54009 is a runtime Power Management (PM) reference leak vulnerability in the Linux kernel's i2c-cadence driver. Specifically, the cdns_i2c_master_xfer() function acquires a runtime PM reference upon entry but fails to release it on one particular error exit path, resulting in a resource leak. The vulnerability affects the Linux kernel starting from version 5.8, with fixes backported to stable releases including 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. It was published on December 24, 2025, and NVD has not yet assigned a CVSS score; the EPSS score is approximately 0.024% (Feedly, NVD).

The root cause is a missing runtime PM reference release (pm_runtime_put() or equivalent) on an error exit path within cdns_i2c_master_xfer() in the Cadence I2C driver (drivers/i2c/busses/i2c-cadence.c). When the function is entered, it increments the runtime PM usage count; under normal operation this is decremented on exit, but one error branch returns directly without performing the decrement, causing a PM reference leak (CWE not formally assigned by NVD). This type of resource management error (analogous to CWE-772: Missing Release of Resource after Effective Lifetime) can prevent the I2C device from entering low-power states. The fix ensures the error path also calls the appropriate PM release function before returning (Feedly, NVD).

The primary impact of this vulnerability is a denial of power management functionality: the affected I2C Cadence controller device will be prevented from suspending or entering low-power states after the error condition is triggered, leading to increased power consumption on embedded or SoC-based systems using this driver. There is no known confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation. The practical effect is limited to systems using the Cadence I2C controller hardware, which is common in Xilinx/AMD SoC platforms (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Users should update to the following patched versions or later: Linux 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, or 6.4. The relevant upstream commits are available at the kernel.org stable tree. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, NVD).