CVE-2023-54097: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54097 is a resource leak vulnerability in the Linux kernel's STM32 PWR regulator driver (drivers/regulator/stm32-pwr.c). The flaw causes an I/O memory mapping obtained via of_iomap() to not be released under certain error conditions in the stm32_pwr_regulator_probe() function, resulting in a memory/resource leak. It was published on December 24, 2025, and affects Linux kernel versions from the introduction of the vulnerable code (commit dc62f951a6a8) up to the patched stable releases. Fixed versions include kernel 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. No CVSS base score has been assigned by the Linux kernel CNA; the EPSS score is approximately 0.024% (Feedly, ENISA EUVD).

The root cause is a missing resource release (CWE-772: Missing Release of Resource after Effective Lifetime) in the stm32_pwr_regulator_probe() function within drivers/regulator/stm32-pwr.c. When of_iomap() successfully maps I/O memory into base, but a subsequent call to either devm_kzalloc() or devm_regulator_register() fails, the mapped memory region is never unmapped, causing a leak. The fix replaces of_iomap() with devm_platform_ioremap_resource(), which integrates with the kernel's device-managed resource framework (devres) to automatically release the mapping on probe failure or device removal. Additionally, the error check is updated from !base to IS_ERR(base) to correctly handle the ERR_PTR()-encoded error codes returned by the new function (Feedly, ENISA EUVD).

The vulnerability results in a kernel resource leak — specifically, an unreleased I/O memory mapping — when the STM32 PWR regulator driver probe fails under specific error conditions. This is a local, low-severity issue confined to systems using STM32-based hardware with the affected regulator driver. The practical impact is limited to potential memory exhaustion or resource starvation over time in affected embedded/IoT environments, with no direct path to privilege escalation, data exfiltration, or remote code execution (Feedly).

There is no known public exploit code, proof-of-concept, or evidence of in-the-wild exploitation for CVE-2023-54097. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. The issue is hardware-specific (STM32 platform devices) and requires local access to trigger the affected probe path (Feedly).

Apply the upstream Linux kernel patches that replace of_iomap() with devm_platform_ioremap_resource() in the STM32 PWR regulator driver. Fixed stable kernel versions are: 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. Distributions shipping kernels for STM32-based platforms should update to these versions or apply the relevant backported patches. No configuration-based workaround is available; upgrading the kernel is the only remediation (ENISA EUVD, Feedly).