CVE-2023-54136: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54136 is a memory leak vulnerability in the Linux kernel's serial: sprd (Spreadtrum serial) driver. The flaw occurs because DMA buffers are not released when the _probe() function returns a failure, resulting in a kernel memory leak. It affects Linux kernel versions from 5.2 up to (but not including) the patched stable releases. Fixed versions include 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6. The vulnerability was published on December 24, 2025, and carries an EPSS score of approximately 0.024% (very low), with no CVSS base score assigned (Feedly, ENISA EUVD).

The root cause is a missing resource cleanup path in the Spreadtrum (SPRD) serial driver's probe function (CWE-401: Missing Release of Memory after Effective Lifetime). When sprd_probe() encounters an error and returns early, it fails to free previously allocated DMA buffers, leaving them permanently leaked in kernel memory. This is a local, kernel-space issue — exploitation would require the ability to trigger repeated probe failures (e.g., via module reload or hardware hotplug events on affected Spreadtrum-based platforms), causing gradual kernel memory exhaustion (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak (availability impact), where DMA buffers allocated during failed probe attempts are never freed. On systems using Spreadtrum serial hardware, repeated probe failures could gradually exhaust kernel memory, potentially leading to system instability or denial of service. There is no known confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (Feedly).

There is no known public exploit code, no evidence of in-the-wild exploitation, and this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation. The vulnerability is limited to systems running Spreadtrum (SPRD) serial hardware, which significantly narrows the affected population (Feedly).

Apply the upstream Linux kernel patches that introduce proper DMA buffer cleanup in the sprd_probe() error path. Fixed stable kernel versions are: 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6. Administrators should update to the appropriate patched stable release for their kernel branch. As a workaround, systems not using Spreadtrum serial hardware are not affected and require no action (ENISA EUVD, Feedly).