CVE-2023-54154: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54154 is a memory leak vulnerability in the Linux kernel's SCSI target core subsystem. The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in kernel memory leaks across various transport types including iSCSI and TCM loop. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the introduction of target_alloc_cmd_counter() up to the patched commits in the 6.1.x and 6.5.x stable series. No CVSS base score has been assigned; the EPSS score is approximately 0.017% (Feedly).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's drivers/target/target_core_transport.c. When target_setup_session() is called — for example, via tcm_loop_tpg_nexus_store() writing to a configfs entry — it invokes target_alloc_cmd_counter(), which allocates a 96-byte target_cmd_counter struct via kmalloc. This struct is never freed when the corresponding iscsit_conn or se_sess parent session is torn down, causing a persistent kernel heap leak. The backtrace in the vulnerability description shows the allocation path: configfs_write_iter → tcm_loop_tpg_nexus_store → target_setup_session → target_alloc_cmd_counter → kmalloc_trace (Feedly).

The primary impact is a kernel memory leak that degrades system availability over time. On systems running iSCSI targets or TCM loop transports with frequent session setup and teardown, the unreleased 96-byte allocations accumulate on the kernel heap, potentially leading to memory exhaustion and system instability or denial of service. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix was applied to the Linux kernel stable trees via three commits: 1cd41d1669bc (6.6 stable), f84639c5ac5f (6.5.x stable), and d14e3e553e05 (6.1.x stable). The patch frees the target_cmd_counter struct alongside the corresponding iscsit_conn or se_sess parent when a session is destroyed. Users should update to Linux kernel versions 6.1.55+, 6.5.5+, or 6.6+ to receive the fix. No configuration-based workaround is available; upgrading the kernel is the only remediation (Feedly, Kernel Patch 6.6, Kernel Patch 6.5, Kernel Patch 6.1).