CVE-2023-54064: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54064 is a memory leak vulnerability in the Linux kernel's IPMI SSIF (System Management Interface via SMBus) driver. The flaw exists in the ssif_info_find() function, which sets info->adapter_name when adapter information is sourced from SMBIOS, but fails to check whether the field has already been set before reassigning it. Since this function can be called multiple times, repeated calls leak the previously allocated adapter name string. The vulnerability was published on December 24, 2025, and affects multiple stable Linux kernel branches. No CVSS score has been formally assigned; the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a missing NULL check before assigning info->adapter_name in the ssif_info_find() function within the Linux kernel's drivers/char/ipmi/ipmi_ssif.c (CWE-401: Missing Release of Memory after Effective Lifetime). When the IPMI SSIF adapter scan is triggered more than once and adapter information originates from SMBIOS, the function overwrites the existing pointer without freeing the previously allocated memory, resulting in a kernel memory leak. The fix adds a NULL check so that info->adapter_name is only set if it has not already been assigned. Patches have been applied across multiple stable kernel branches, with commit hashes available in the upstream stable tree (Feedly).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time. This may degrade system stability and availability, potentially leading to performance degradation or system crashes in long-running environments where the IPMI SSIF adapter scan is triggered repeatedly. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6 and later. Administrators should update to a patched kernel version for their respective stable branch. SUSE has also issued advisories incorporating these fixes for affected distributions (Feedly, Linux Security).