CVE-2023-54109: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54109 is a reference count leak vulnerability in the Linux kernel's media: rcar_fdp1 driver. The flaw exists in the fdp1_probe() and fdp1_remove() functions, where rcar_fcp_get() acquires a reference that is not properly balanced by a corresponding rcar_fcp_put() call in error paths and during device removal. The vulnerability affects Linux kernel versions from 4.10 up to the respective stable branch fix points. It was published on December 24, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, ENISA EUVD).

The root cause is a missing reference count decrement (CWE-772: Missing Release of Resource after Effective Lifetime) in the rcar_fdp1 media driver for Renesas R-Car SoCs. When fdp1_probe() encounters an error after calling rcar_fcp_get(), or when fdp1_remove() is invoked, the corresponding rcar_fcp_put() is not called, resulting in a reference count leak. The fix adds the missing rcar_fcp_put() calls in the error paths of fdp1_probe() and in fdp1_remove() (which was updated to return void). Patches were applied across multiple stable kernel branches (Feedly, ENISA EUVD).

The primary impact of this vulnerability is a kernel resource leak — specifically, an unreleased reference to an FCP (Frame Compression Processor) device — which can prevent proper cleanup during driver probe failures or device removal. This may result in the FCP device being held in an unusable state, potentially causing denial-of-service conditions for media processing functionality on affected Renesas R-Car hardware. The vulnerability does not appear to enable remote code execution or direct privilege escalation, and its impact is largely limited to availability of the affected media subsystem on embedded/automotive Linux platforms (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54109. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000240, reflecting minimal exploitation probability. The vulnerability is detected by Nessus plugin 280053 (Tenable, Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include: 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4 (mainline). Users running affected kernels on Renesas R-Car hardware with the rcar_fdp1 driver should update to the appropriate patched stable release. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (ENISA EUVD, Feedly).