CVE-2023-54075: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2023-54075 is a reference count leak vulnerability in the Linux kernel's ASoC (Audio System on Chip) MediaTek common driver, specifically in the parse_dai_link_info function. The flaw arises from missing of_node_put() calls that fail to balance corresponding of_node_get() calls when the for_each_available_child_of_node loop exits early. Affected versions include Linux kernel commits from 4302187d955f up to (but not including) beed115c2ce7 (stable 6.3.x branch) and 3e40722d5580 (stable 6.4 branch), with fixes backported to kernel 6.3.2 and 6.4. The CVSS base score is reported as 0.0, indicating low assessed severity (Feedly, ENISA EUVD).

The root cause is an improper resource management issue (CWE-401 / resource leak) in the parse_dai_link_info function within sound/soc/mediatek/common/. When iterating over device tree child nodes using for_each_available_child_of_node, the macro internally calls of_node_get() to increment the reference count of each node. If the loop returns early (e.g., due to an error condition), the corresponding of_node_put() calls are not made, leaving the reference count unbalanced and causing a memory/reference leak. The fix adds the missing of_node_put() calls on all early-return paths to properly release the device tree node references (Feedly, Linux Kernel Stable).

The primary impact of this vulnerability is a kernel resource (reference count) leak in systems using MediaTek ASoC drivers, which could lead to memory exhaustion or incorrect device tree node lifecycle management over time. In practice, this is a low-severity issue that does not directly enable remote code execution, privilege escalation, or data exfiltration. The availability impact is limited to potential system instability or resource exhaustion on affected embedded or mobile Linux systems using MediaTek audio hardware (Feedly).

The fix has been merged into the Linux kernel stable trees. Users should update to Linux kernel 6.3.2 or later (for the 6.3.x branch) or kernel 6.4 or later (for the 6.4 branch), which include the corrective commits beed115c2ce7 and 3e40722d5580 respectively. Linux distributions shipping affected kernel versions with MediaTek ASoC support should apply available vendor kernel updates. No specific configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Linux Kernel Stable, ENISA EUVD).