CVE-2023-54175: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54175 is a runtime PM (Power Management) reference leak vulnerability in the Linux kernel's i2c-xiic driver. Specifically, the xiic_xfer() function acquires a runtime PM reference upon entry but fails to release it on one error exit path, resulting in a resource leak. The vulnerability affects Linux kernel versions from commit fdacc3c7405d1fc33c1f2771699a4fc24551e480 up to the patched commits across multiple stable branches, with fixes landing in versions 6.1.28, 6.2.15, 6.3.2, and 6.4. It was published on December 30, 2025, and carries an EPSS score of approximately 0.032% (very low), with no CVSS base score assigned (Feedly, ENISA EUVD).

The root cause is a missing pm_runtime_put() call on an error path within the xiic_xfer() function in drivers/i2c/busses/i2c-xiic.c of the Linux kernel (CWE-772: Missing Release of Resource after Effective Lifetime). When xiic_xfer() is entered, it increments the runtime PM usage counter via pm_runtime_get_sync(). Under a specific error condition, the function returns early without calling the corresponding pm_runtime_put(), causing the PM reference count to remain elevated. This prevents the device from entering low-power states and can lead to resource exhaustion over time. The fix ensures the error path properly releases the runtime PM reference before returning (Feedly, Kernel Git).

The primary impact of this vulnerability is a runtime PM reference leak in the Xilinx IIC (i2c-xiic) driver, which prevents the affected I2C device from suspending or entering low-power states. Over repeated triggering of the error path, the accumulated unreleased references can lead to resource exhaustion and potential denial of service on embedded or FPGA-based systems using the Xilinx IIC controller. There is no known confidentiality or integrity impact; the vulnerability is limited to availability degradation on affected hardware platforms (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 6.1.28, 6.2.15, 6.3.2, and 6.4. Administrators running affected kernel versions on systems with Xilinx IIC hardware should update to a patched kernel version. The specific fix commits are available in the kernel stable tree: 2d320d9de7d3 (6.3.x), 72cb227a368c (6.2.x), 06e661a25997 (6.1.x), 6027d84c073e, 688fdfc458bf, and d663d93bb47e (Kernel Git, ENISA EUVD).