CVE-2023-54020: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54020 is a memory leak vulnerability in the Linux kernel's dmaengine: sf-pdma driver, caused by a missing kfree() call in sf_pdma_free_desc(). The flaw was introduced by commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), which changed sf_pdma_prep_dma_memcpy() to unconditionally allocate a new sf_pdma_desc on every call without updating the corresponding free logic. Affected Linux kernel versions span from the introduction of commit b2cc5c465c2c up to the patched releases in stable branches (5.15.99, 6.1.16, 6.2.3, and 6.3). The CVE was published on December 24, 2025, and NVD has not yet assigned a CVSS score; Feedly estimates the severity as Medium (Feedly, CVE Record).

The root cause is a memory management error (CWE category: memory leak) in the Linux kernel's SiFive Platform DMA (sf-pdma) driver. When multithread support was added via commit b2cc5c465c2c, the descriptor recycling logic (based on an in_use flag) was removed, causing sf_pdma_prep_dma_memcpy() to allocate a new sf_pdma_desc object from the slab cache on every invocation. However, sf_pdma_free_desc() was not updated to free the previously allocated descriptor, resulting in a persistent kernel memory leak. Over time, repeated DMA operations cause memory starvation, as confirmed by kmemleak traces showing unreferenced 192-byte objects allocated via kmem_cache_alloc in sf_pdma_prep_dma_memcpy (CVE Record).

The primary impact of this vulnerability is a gradual degradation of system availability due to kernel memory exhaustion (memory starvation). Each invocation of sf_pdma_prep_dma_memcpy() leaks a 192-byte kernel slab object; on systems performing frequent DMA operations (e.g., embedded or IoT devices using the SiFive PDMA controller), this can eventually exhaust kernel memory and cause system instability or a crash. There is no direct confidentiality or integrity impact, and exploitation does not enable privilege escalation or remote code execution (Feedly).

The fix adds the missing kfree() call to sf_pdma_free_desc() and removes the now-redundant in_use flag. Patches have been applied to the following stable kernel branches: 5.15.99, 6.1.16, 6.2.3, and 6.3. Users running affected kernel versions on hardware with the SiFive PDMA controller should upgrade to a patched stable release. The relevant upstream fix commits are 03fece43fa10, 8bd5040bd43f, ad222c9af25e, and b02e07015a5a (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3, kernel.org patch 4).