CVE-2023-54104: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54104 is an off-by-one error in the Linux kernel's MTD raw NAND subsystem, specifically in the fsl_upm driver's fun_exec_op() function. The flaw allows an array index equal to NAND_MAX_CHIPS to be used when accessing the mchip_offsets and rnb_gpio arrays, which are sized to NAND_MAX_CHIPS elements, resulting in potential out-of-bounds memory access. The vulnerability was introduced at commit 54309d65776755bcdb9dcf3744cd764fc1e254ea and affects Linux kernel versions prior to the fixes backported into stable releases 5.10.190, 5.15.126, 6.1.45, 6.4.10, and 6.5 (Feedly, ENISA EUVD). The CVE was published on December 24, 2025. No CVSS base score has been assigned at this time (Feedly).

The root cause is an off-by-one boundary check error (CWE-193) in the fun_exec_op() function of the drivers/mtd/nand/raw/fsl_upm.c driver. The value op->cs is copied into fun->mchip_number and subsequently used as an index into the mchip_offsets and rnb_gpio arrays, both of which have exactly NAND_MAX_CHIPS elements (valid indices: 0 to NAND_MAX_CHIPS - 1). The original sanity check incorrectly permitted the index to equal NAND_MAX_CHIPS, allowing a one-element out-of-bounds read or write. The fix corrects the comparison to strictly enforce that the index must be less than NAND_MAX_CHIPS (Feedly, ENISA EUVD). Exploitation would require local access to a system with the fsl_upm NAND controller driver loaded, which is typically found on embedded or industrial hardware using Freescale/NXP SoCs.

Successful exploitation of this vulnerability could result in out-of-bounds memory reads or writes within the kernel, potentially leading to information disclosure of kernel memory contents or memory corruption. In a worst-case scenario, memory corruption could be leveraged to escalate local privileges or cause a kernel panic, impacting system availability. The practical impact is limited by the specialized hardware requirement (Freescale UPM-based NAND controllers), reducing the affected population to embedded and industrial Linux systems using this specific driver (Feedly, ENISA EUVD).

The Linux kernel stable team has released patches addressing this vulnerability across multiple stable branches. Users should update to kernel versions 5.10.190, 5.15.126, 6.1.45, 6.4.10, or 6.5 (or later), which contain the corrected boundary check in fun_exec_op() (ENISA EUVD). On systems where the fsl_upm driver is not required, it can be blacklisted as a workaround. Administrators of embedded or industrial Linux systems using Freescale/NXP SoCs with UPM-based NAND controllers should prioritize applying the relevant kernel update.