CVE-2023-54169: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54169 is a memory leak vulnerability in the Linux kernel's net/mlx5e driver, specifically within the mlx5e_ptp_open function. When kvzalloc_node or kvzalloc fails during PTP (Precision Time Protocol) channel initialization, the memory pointed to by the c or cparams variables is not properly freed, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from the introduction of the affected code (commit 145e5637d941) up to the patched stable releases. It was published on December 30, 2025, with an EPSS score of 0.023% (Low) and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is improper resource cleanup on error paths (CWE-401: Missing Release of Memory after Effective Lifetime). In mlx5e_ptp_open, when kernel memory allocation functions kvzalloc_node or kvzalloc return failure, the function exits without freeing previously allocated memory buffers referenced by the local pointers c and cparams. The fix adds explicit kvfree() calls in the error path to release these allocations. This is a local, kernel-internal issue triggered under memory pressure conditions and does not involve external network input or user-supplied data (Feedly, EUVD).

The primary impact is a kernel memory leak in systems using Mellanox/NVIDIA mlx5e network adapters with PTP functionality enabled. Repeated triggering of the error path (e.g., under sustained memory pressure) could gradually exhaust kernel memory, potentially degrading system stability or availability over time. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include kernel 5.15.121, 6.1.40, 6.4.5, and 6.5 (mainline). Users should update to these or later stable kernel releases. No configuration-based workaround is available; upgrading the kernel is the recommended remediation. Systems not using Mellanox/NVIDIA mlx5e adapters or PTP functionality are not affected (EUVD, Feedly).