CVE-2023-54072: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54072 is a data race vulnerability in the Linux kernel's ALSA PCM (Advanced Linux Sound Architecture, Pulse Code Modulation) memory allocation subsystem. The flaw exists in the PCM memory allocation helpers, where a sanity check against excessive buffer allocations is performed without proper locking, allowing a user to allocate more memory than the predefined maximum size. It affects the Linux kernel across a wide range of versions (from the initial commit 1da177e4c3f4 up to the patched stable releases). The vulnerability was published on December 24, 2025, with fixes backported to stable branches including 5.4.255, 5.10.193, 5.15.129, 6.1.39, 6.4.4, and 6.5. No CVSS score has been formally assigned; the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-362) in the do_alloc_pages() function within the ALSA PCM memory allocation helpers. The size check against the maximum allowed buffer allocation is performed without holding the card->memory_mutex lock, meaning concurrent allocation requests can bypass the soft limit and collectively allocate more memory than intended. The fix serializes the size check and the subsequent size increment under card->memory_mutex, and rolls back the size counter if the actual allocation fails. Exploitation requires local access to the system and the ability to make concurrent PCM buffer allocation requests (Feedly, EUVD).

The practical impact of this vulnerability is limited. A local user can bypass the soft memory allocation limit in the ALSA PCM subsystem, potentially allocating more kernel memory buffers than intended, but cannot allocate memory without bound. This may lead to minor resource exhaustion or inconsistent subsystem behavior, but does not directly enable privilege escalation, arbitrary code execution, or data exfiltration. The vulnerability's own description characterizes it as not a "big problem" in practice, as the limit is a sanity check rather than a hard security boundary (Feedly).

The Linux kernel maintainers have released patches for all affected stable branches. Users should update to the following fixed versions or later: 5.4.255, 5.10.193, 5.15.129, 6.1.39, 6.4.4, or 6.5. Distribution-specific updates (e.g., SUSE kernel updates) have also been released. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, EUVD).