CVE-2023-54078: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54078 is a memory leak vulnerability in the Linux kernel's media: max9286 driver, where the V4L2 control handler is not properly freed in certain probe-time error paths and during device removal. The flaw affects Linux kernel versions starting from commit 66d8c9d2422da21ed41f75c03ba0685987b65fe0 (introduced in kernel 5.9) up to the patched stable releases. Fixed versions include Linux 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. It was published on December 24, 2025, with an EPSS score of 0.024% (Low), and no CVSS base score has been assigned (Feedly, EUVD).

The root cause is a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the max9286 GMSL deserializer driver within the Linux kernel's media subsystem. The V4L2 control handler allocated during driver probe is not released when subsequent initialization steps fail, nor when the driver is unloaded via the remove path. This results in a kernel memory leak each time the driver is probed unsuccessfully or removed. The fix involves adding the appropriate v4l2_ctrl_handler_free() calls in the relevant error and cleanup paths (Feedly, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust kernel memory resources over time, potentially leading to system instability or denial of service on affected systems. The vulnerability is limited to systems using the max9286 GMSL camera deserializer hardware (commonly found in automotive and embedded Linux platforms). There is no known path to privilege escalation, code execution, or data exfiltration from this vulnerability (Feedly).

Apply the upstream Linux kernel patches that introduce the missing v4l2_ctrl_handler_free() calls in the max9286 driver. The following stable kernel versions contain the fix: 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. Distributions using affected kernel versions (5.9 through the above patch points) should update to a patched release. As a workaround on systems where the max9286 hardware is not present, the driver module can be blacklisted to prevent loading (EUVD, Feedly).