CVE-2023-54189: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54189 is a NULL pointer dereference vulnerability in the Linux kernel's pstore/ram subsystem, caused by a missing return value check for kstrdup(). If kstrdup() fails (e.g., due to memory exhaustion), the returned NULL pointer is subsequently dereferenced, potentially causing a kernel crash. The vulnerability was published on December 30, 2025, and affects Linux kernel versions prior to the patched stable releases. The CVSS base score is listed as 0.0 in available databases, suggesting it has not yet received a formal severity rating (EUVD, Feedly).

The root cause is a missing NULL check after calling kstrdup() in the pstore/ram driver (CWE-476: NULL Pointer Dereference). When the kernel's memory allocator fails to duplicate a string, kstrdup() returns NULL; without a validity check, subsequent code dereferences this NULL pointer, triggering a kernel oops or panic. The fix adds an explicit check for the return value of kstrdup() and propagates the error appropriately to prevent the dereference. Patches were applied across multiple stable kernel branches (kernel.org patch 5.4.251, kernel.org patch 6.1.39).

Successful triggering of this vulnerability results in a kernel NULL pointer dereference, which typically causes a system crash (kernel panic/oops), leading to a denial of service. Because the flaw resides in the pstore/ram subsystem — responsible for persistent storage of kernel crash logs — it is most likely to be triggered during memory pressure conditions or when the pstore subsystem is actively used. There is no evidence of confidentiality or integrity impact; the primary risk is availability (EUVD).

The Linux kernel maintainers have released fixes across multiple stable branches. Patched versions include: 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5. Users should update their Linux kernel to one of these patched versions or later. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (EUVD, kernel.org).