CVE-2023-54112: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54112 is a memory leak vulnerability in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem, specifically in the kcm_sendmsg() function located in net/kcm/kcmsock.c. The flaw causes unreferenced socket buffer (skb) objects to be leaked when an error occurs mid-transmission after some bytes have already been copied. It was published on December 24, 2025, and affects multiple stable Linux kernel versions. The CVSS score has not been publicly assigned a severity rating in available sources, and the EPSS score is 0.000240 (very low) (Feedly).

The root cause is a missing cleanup path in kcm_sendmsg() (CWE-401: Missing Release of Memory after Effective Lifetime). In the function, kcm_tx_msg(head)->last_skb is used as a cursor to append newly allocated skbs to a head buffer. If an error occurs after some bytes have been copied into newly allocated skbs, those skbs are not freed before the function returns, resulting in a kernel memory leak. The bug was identified by syzbot (Google's kernel fuzzing infrastructure), which reported unreferenced objects of size 240 bytes allocated via __alloc_skb in net/core/skbuff.c. Fixes were applied across multiple stable kernel branches via patches referenced in the Linux stable git repository (Feedly).

The vulnerability results in a kernel memory leak, degrading system availability over time as kernel memory is exhausted without being reclaimed. An attacker or unprivileged local user with access to KCM sockets could potentially trigger repeated memory leaks, leading to denial of service conditions on affected systems. There is no evidence of confidentiality or integrity impact; the primary risk is availability through resource exhaustion (Feedly).

The fix has been applied to multiple Linux stable kernel branches via patches in the Linux stable git repository (commits: 5e5554389397, 8dc7eb757b16, 33db24ad811b, 479c71cda14b, 16989de75497). Administrators should update to a patched kernel version that includes these fixes. No configuration-based workaround is known; upgrading the kernel is the recommended remediation. Systems can be assessed for exposure using Qualys or Nessus plugins (Feedly, Tenable Nessus).