CVE-2023-54050: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54050 is a memory leak (memleak) vulnerability in the Linux kernel's UBIFS (Unsorted Block Images File System) subsystem. The flaw occurs in the dirty_cow_znode() function when insert_old_idx() fails after copy_znode() has already allocated a new znode — the copied znode is never freed, resulting in a kernel memory leak. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from 2.6.27 up to the patched stable releases. The CVSS base score has not been formally assigned (estimated Medium severity by Feedly), and the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a missing resource cleanup path in the UBIFS dirty_cow_znode() function, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When copy_znode() allocates a new znode (zn) and the subsequent insert_old_idx() call fails, the function returns an error pointer without freeing zn, leaving the allocated memory unreferenced and unrecoverable. The fix refactors copy_znode() and insert_old_idx() into two-phase operations (resource allocation and replacement/insertion), enabling proper cleanup in the error handling path without corrupting in-memory or on-disk metadata. The vulnerability requires a local attacker or process with access to a UBIFS-mounted filesystem to trigger the error condition (Feedly, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on systems using UBIFS-mounted flash storage. Repeated triggering of the vulnerable code path could degrade system performance and potentially lead to denial of service (system instability or OOM conditions). There is no known direct path to privilege escalation, code execution, or data exfiltration from this vulnerability; confidentiality and integrity impacts are considered negligible (Feedly).

The vulnerability is fixed in the following Linux kernel stable releases: 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. Users should update to the appropriate patched stable kernel version for their distribution. No configuration-based workaround is available; the recommended action is to apply the upstream kernel patch corresponding to the relevant stable branch (EUVD, Kernel Patch 1, Kernel Patch 2).