CVE-2023-54017: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54017 is a memory leak vulnerability in the Linux kernel's powerpc/pseries subsystem, specifically within the ibmebus_bus_init() function. When device_register() returns an error, the kobject name allocated by dev_set_name() (called internally by device_add()) is not properly freed because put_device() is not called to drop the reference count set by device_initialize(). This prevents kobject_cleanup() from freeing the name string, resulting in a kernel memory leak. The vulnerability was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. No CVSS score has been assigned by NVD at this time (Feedly).

The root cause is improper resource cleanup on error paths in ibmebus_bus_init(), classified as a memory management issue (CWE not formally assigned by NVD). When device_register() fails, the code does not invoke put_device() as required by the device_add() API contract, leaving the kobject name string allocated by dev_set_name() unreachable and unfreed. The fix, applied across multiple stable kernel branches, ensures put_device() is called on the error path so that kobject_cleanup() can properly release the allocated name. Patches are available in the kernel stable tree for branches 4.14, 4.19, 5.4, 5.10, 5.15, 6.1, 6.5, and 6.6 (kernel.org patches).

The vulnerability causes a kernel memory leak on IBM ebus (ibmebus) bus initialization failure paths, affecting availability and long-term system stability on PowerPC/pseries systems. Repeated triggering of the error path could gradually exhaust kernel memory, potentially leading to degraded performance or system instability over time. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation.

CVE-2023-54017 has an EPSS score of approximately 0.024% (0.000240), indicating a very low probability of exploitation in the wild. There are no known public exploits, proof-of-concept code, or reports of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a PowerPC/pseries system and the ability to trigger the specific error condition in ibmebus_bus_init() (Feedly).

Apply the upstream kernel patches available for the affected stable branches: 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, and 6.6. Linux distribution vendors such as SUSE have also released updated kernel packages incorporating this fix. Administrators running PowerPC/pseries systems should update to a patched kernel version as part of routine maintenance (kernel.org patches, Feedly).