CVE-2023-54190: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54190 is a reference count (refcount) leak vulnerability in the Linux kernel's LED subsystem, specifically in the of_led_get() function within leds/led-core.c. The flaw arises because class_find_device_by_of_node() internally calls class_find_device(), which increments the device reference count, but the reference is never released via put_device() when it is no longer needed. The vulnerability was published on December 30, 2025, and affects Linux kernel versions starting from commit 699a8c7c4bd3 up to the respective fix commits across multiple stable branches. The CVSS base score is listed as 0.0 (no severity rating assigned) and the EPSS score is approximately 0.026% (Feedly, EUVD).

The root cause is a missing put_device() call in the of_led_get() function in the Linux kernel's LED core driver (CWE-401: Missing Release of Memory after Effective Lifetime / resource leak). When class_find_device_by_of_node() is called, it internally invokes class_find_device(), which takes a reference to the found device object by incrementing its reference counter. If the caller does not subsequently call put_device() to release this reference, the device object's reference count is permanently inflated, preventing proper cleanup. The fix involves adding the appropriate put_device() call after the reference is no longer needed in of_led_get() (Feedly, EUVD).

The primary impact of this vulnerability is a kernel resource leak — specifically, device object reference counts that are never decremented, which can prevent proper device teardown and memory reclamation. Over time or under repeated triggering conditions, this could contribute to memory exhaustion or instability in the kernel's device management subsystem. The vulnerability does not directly enable remote code execution, privilege escalation, or data exfiltration, making its practical security impact low in most deployment scenarios (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches. The patched versions and corresponding fix commits are:

• 5.10.x: patched at 5.10.173 (commit d880981b82223f9bf128dfdd2424abb0c658f345)
• 5.15.x: patched at 5.15.99 (commit ddf3e82164afd9381b1d52c9f00b3878f7b6d308)
• 6.1.x: patched at 6.1.16 (commit 1d6101d9222e1ca8c01b3fa9ebf0dcf7bcd82564)
• 6.2.x: patched at 6.2.3 (commit 690efcb5827c3bacbf1de90cd14907b91bf8cb7b)
• 6.3+: patched in 6.3 (commit da1afe8e6099980fe1e2fd7436dca284af9d3f29)

Administrators should update their Linux kernel to a patched version for their respective stable branch. No configuration-based workaround is available for this kernel-level resource leak (Feedly, EUVD).