CVE-2023-54171: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54171 is a memory leak vulnerability in the Linux kernel's tracing subsystem, specifically in the handling of the trace_pipe file. When reading trace_pipe, the iter->temp buffer is allocated or reallocated within trace_find_next_entry() but is never freed when the file descriptor is closed, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from the introduction of the relevant code path (around kernel 5.7) up to the fixed versions: 5.10.188, 5.15.121, 6.1.40, 6.4.5, and 6.5. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.024% (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's tracing subsystem. When a process reads from the /sys/kernel/debug/tracing/trace_pipe file, the function trace_find_next_entry() allocates or reallocates the iter->temp buffer via __kmalloc during calls to trace_print_lat_context() and print_trace_line(). However, tracing_release_pipe() — the cleanup function called when the file is closed — does not free this buffer, leaving it as an unreferenced kernel heap object. The fix involves adding a kfree(iter->temp) call in tracing_release_pipe() to ensure the buffer is released upon file closure (Feedly, Kernel Patch 6.1).

The primary impact is a kernel memory leak, which degrades system availability over time as unreleased heap memory accumulates each time trace_pipe is read and closed. On long-running systems with frequent tracing activity, this could contribute to memory exhaustion, potentially causing performance degradation or system instability. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should upgrade to the following patched versions or later: 5.10.188, 5.15.121, 6.1.40, 6.4.5, or 6.5. The upstream fix commits are available in the stable kernel tree for each affected branch. As a workaround, restricting access to the trace_pipe debugfs file (e.g., via filesystem permissions or by not mounting debugfs) can reduce exposure, though upgrading to a patched kernel is the recommended remediation (Feedly, EUVD).