CVE-2023-54123: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54123 is a memory leak vulnerability in the Linux kernel's md/raid10 subsystem, specifically in the raid10_run() function's error handling path. When raid10_run() encounters an error, the conf structure is freed but conf->bio_split is not released, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from the introduction of the affected code (commit fc9977dd069e) up to the patched stable releases. Fixed versions include Linux kernel 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. The CVSS base score is reported as 0.0 (no severity rating assigned at time of publication) (ENISA EUVD).

The root cause is a missing memory deallocation in the error path of raid10_run() within the Linux kernel's md/raid10 module (CWE-401: Missing Release of Memory after Effective Lifetime). Specifically, when raid10_run() fails, the conf structure is freed at three different code locations, but none of them release the conf->bio_split bio set, causing a kernel memory leak. The fix refactors the cleanup logic by introducing a helper function that consolidates all three conf free paths, ensuring conf->bio_split is always properly released. No public proof-of-concept exploit code is known for this vulnerability (ENISA EUVD).

Successful triggering of this vulnerability results in a kernel memory leak within the RAID10 subsystem, degrading system availability over time as kernel memory is gradually exhausted. The impact is limited to availability (denial of service through resource exhaustion) and does not directly expose confidential data or allow unauthorized code execution. Systems running software RAID10 arrays that encounter error conditions during raid10_run() are most at risk, particularly in environments with frequent RAID configuration changes or error-prone storage hardware.

Apply the upstream Linux kernel patches that fix the memory leak by updating to the following stable releases: 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, or 6.4 and later. Distribution-specific kernel updates from vendors such as Red Hat should also be applied as available. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (ENISA EUVD).