CVE-2023-54024: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54024 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the coalesced MMIO device registration path. The flaw occurs because kvm_io_bus_unregister_dev() does not destroy the target device upon failure, leaving the allocated coalesced MMIO device object unreferenced and leaked. It was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The CVSS category is estimated as Medium, with an EPSS score of 0.000240 (Feedly, CVE.org).

The root cause is a missing cleanup path in kvm_vm_ioctl_register_coalesced_mmio() (located in virt/kvm/coalesced_mmio.c), classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When kvm_io_bus_unregister_dev() fails after a coalesced MMIO device has been allocated via kzalloc, the code does not free the allocated object, resulting in a kernel memory leak. Exploitation requires local access to a KVM-enabled system with the ability to issue KVM_REGISTER_COALESCED_MMIO ioctls. The bug was identified via syzkaller fuzzing, as evidenced by the backtrace referencing syz-executor (Feedly, CVE.org).

The primary impact is a kernel memory leak, which can gradually exhaust kernel memory resources on affected systems running KVM workloads. Repeated triggering of the vulnerable code path could degrade system stability or contribute to denial-of-service conditions. There is no direct evidence of confidentiality or integrity compromise, and the vulnerability does not enable arbitrary code execution on its own (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches, referenced by commits 10c2a20d73e9, 76a9886e1b61, 999439fd5da5, b1cb1fac22ab, and ccf6a7fb1aed on kernel.org. Users should update to a patched kernel version that includes these fixes. Distributions such as SUSE have issued advisories (e.g., SUSE-2026-0350) incorporating the fix; users of affected distributions should apply available kernel updates promptly (Feedly, Linux Security).