CVE-2023-54194: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54194 is a memory allocation vulnerability in the Linux kernel's exFAT filesystem driver. The issue arises when mounting an exFAT-formatted device (such as a USB drive) on a system with fragmented physical memory, causing kmalloc_array to fail during large contiguous allocation requests (order:4 page allocation failure), which can prevent the device from being recognized. The fix replaces kmalloc_array/kfree with kvmalloc_array/kvfree to allow fallback to vmalloc when contiguous physical memory is unavailable. The vulnerability was published on December 30, 2025, and has an EPSS score of 0.024% (Feedly).

The root cause is an improper resource allocation (CWE-400 / resource exhaustion) in the exFAT filesystem's load_alloc_bitmap function, called during exfat_fill_super at mount time. On long-running systems where physical memory is fragmented, kmalloc_array cannot satisfy large contiguous allocation requests (order:4), causing a page allocation failure and preventing the exFAT volume from mounting. The fix substitutes kvmalloc_array/kvfree, which transparently falls back to vmalloc (virtually contiguous, not physically contiguous) when the slab allocator cannot satisfy the request, resolving the fragmentation sensitivity (Feedly). Patches are available in the stable kernel tree at multiple commits (Kernel Git).

The primary impact is an availability issue: when a system's physical memory is sufficiently fragmented, inserting an exFAT-formatted USB drive or other removable storage device will result in a mount failure and the device will not be recognized by the operating system. This does not result in data loss, privilege escalation, or unauthorized data access, but can disrupt workflows dependent on removable exFAT storage on long-running Linux systems (Feedly).

Apply the upstream Linux kernel patches that replace kmalloc_array/kfree with kvmalloc_array/kvfree in the exFAT driver. Relevant stable kernel commits include 0c5c3e8a, 8a34a242, 79d16a84, 1427a7e9, and daf60d6c (Kernel Git). Linux distribution maintainers (e.g., Red Hat) are tracking this fix; users should update to patched kernel versions provided by their distribution as they become available (Vulners/RedHat). As a temporary workaround on affected systems, periodically rebooting to defragment physical memory or reducing memory pressure before mounting exFAT devices may reduce the likelihood of triggering the allocation failure.