CVE-2023-54143: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54143 is a resource leak vulnerability in the Linux kernel's MediaTek video codec (vcodec) driver, specifically within the vdec_msg_queue_init() function. The flaw arises from incomplete error handling during initialization: if memory allocation for msg_queue->wdma_addr fails, the function does not properly set the size to zero or clean up resources before returning, and two additional error paths also fail to perform cleanup. The vulnerability affects Linux kernel versions from 5.18 through stable releases prior to 6.1.53, 6.4.16, 6.5.3, and 6.6. It was published on December 24, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been formally assigned (Red Hat CVE, Feedly).

The root cause is improper resource cleanup on error paths (CWE-401: Missing Release of Memory after Effective Lifetime / resource leak). In vdec_msg_queue_init(), when the first call to allocate msg_queue->wdma_addr fails, the corresponding vdec_msg_queue_deinit() cleanup function becomes a no-op because the size field is never set to zero, leaving resources in an inconsistent state. Two additional error paths in the same function also return without performing cleanup. The fix involves explicitly setting msg_queue->wdma_addr.size = 0 on the first failure path and redirecting the other two error paths to a common mem_alloc_err label that handles cleanup. This is a local, kernel-level issue requiring the ability to trigger video codec initialization on affected MediaTek hardware (Red Hat CVE, EUVD).

Successful triggering of this vulnerability can result in memory leaks and resource exhaustion within the Linux kernel's MediaTek vcodec subsystem. Repeated failed initialization attempts without proper cleanup could degrade system performance, cause instability, or lead to denial-of-service conditions on affected systems. The impact is limited to availability and does not directly expose confidential data or allow privilege escalation, and exploitation is constrained to systems with MediaTek video codec hardware (Feedly).

Patches are available for all affected stable Linux kernel branches. Users should update to kernel versions 6.1.53, 6.4.16, 6.5.3, 6.6, or later, which include the corrected error handling in vdec_msg_queue_init(). The upstream fixes are tracked in commits 858322c409e0, b7dbc27301f5, 451dc187cadd, and cf10b0bb503c on the stable kernel tree. As a general mitigation, monitoring system memory usage on MediaTek-based devices running video workloads is advisable until patching is complete (Red Hat CVE, EUVD).