CVE-2023-54115: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54115 is a memory leak vulnerability in the Linux kernel's PCMCIA subsystem, specifically in the nonstatic_release_resource_db() function within drivers/pcmcia/rsrc_nonstatic.c. When releasing all resources associated with a PCMCIA socket, the function fails to free the socket_data structure, resulting in a kernel memory leak detectable via kmemleak. The vulnerability was published on December 24, 2025, and affects multiple stable Linux kernel versions. It carries a low EPSS score of 0.024%, indicating minimal exploitation probability (Feedly).

The root cause is a missing kfree() call for the socket_data pointer in nonstatic_release_resource_db(), classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During PCMCIA socket teardown, the function iterates and frees individual resource entries but omits freeing the top-level socket_data allocation made during nonstatic_init(). The leak is triggered when a PCMCIA socket is unregistered — for example, when the yenta_socket driver is unloaded — and is observable through the kernel's kmemleak infrastructure, which reports an unreferenced 64-byte object allocated via kmalloc_trace (Feedly). Fixes were applied across multiple stable kernel branches via commits to the kernel stable tree (Kernel Git).

The vulnerability results in a small, bounded kernel memory leak (64 bytes per affected PCMCIA socket) each time a socket is released. There is no known path to privilege escalation, code execution, or data disclosure; the primary impact is on system availability through gradual memory exhaustion in long-running systems with repeated PCMCIA socket registration and deregistration cycles. Systems with PCMCIA hardware (e.g., embedded or legacy systems using Yenta-compatible CardBus controllers) are most at risk of resource exhaustion over time (Feedly).

• Logs: Kernel kmemleak reports referencing an unreferenced object of size 64 bytes with a backtrace through nonstatic_init in pcmcia_rsrc, pcmcia_register_socket in pcmcia_core, and yenta_probe in yenta_socket.
• Process: systemd-udevd process associated with the allocation at the time of PCMCIA socket registration, as shown in kmemleak output (comm "systemd-udevd").
• Kernel: Repeated kmemleak warnings for 64-byte unreferenced objects at addresses allocated via kmem_cache_alloc_node → kmalloc_trace → nonstatic_init after PCMCIA socket teardown.

The fix adds a kfree(s_data) call at the end of nonstatic_release_resource_db() to properly release the socket_data structure. Patches have been applied to multiple Linux stable kernel branches via the kernel stable tree (commits 2d45e2be, 04bb8af4, 97fd1c8e, 22100df1, bde0b6da). Users should update to a patched kernel version that includes these fixes; distributions such as those detected by Nessus plugin 280044 and Qualys detections 760604/761056 should apply available vendor kernel updates (Feedly, Tenable).