CVE-2023-54205: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54205 is a reference count leak vulnerability in the Linux kernel's STM32 pin controller (pinctrl) driver, specifically in the stm32_pctrl_get_irq_domain function. The of_irq_find_parent() function returns a node pointer with an incremented reference count, but the driver fails to call of_node_put() to decrement it when the node is no longer needed, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions from 5.4 through 6.2 (prior to their respective patch releases), and was publicly disclosed on December 30, 2025. It carries an estimated CVSS severity of Medium, with an EPSS score of 0.024% (Red Hat CVE, Feedly).

The root cause is classified as a missing resource release (CWE-772 / improper reference counting) in the Linux kernel's pinctrl/pinctrl-stm32.c driver. When stm32_pctrl_get_irq_domain() calls of_irq_find_parent(), the returned device tree node has its reference count incremented by the kernel's OF (Open Firmware) subsystem; the code path fails to invoke of_node_put() before returning, leaking the reference. This issue is limited to systems using STM32 pin controller hardware and requires the affected code path to be exercised (e.g., during driver initialization or IRQ domain setup). The fix adds the missing of_node_put() call and has been backported to stable kernel branches (Red Hat CVE, Linux Kernel Git).

The refcount leak causes kernel memory to be gradually consumed each time the affected function is called without proper cleanup, potentially leading to memory exhaustion, system performance degradation, or denial of service conditions. The impact is limited to systems running Linux kernels with STM32 pin controller hardware; there is no evidence of confidentiality or integrity compromise, and the vulnerability does not enable privilege escalation or remote code execution. The availability impact is the primary concern, manifesting as progressive kernel memory pressure over time (Red Hat CVE, Feedly).

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Patches have been applied across the following stable kernel versions: 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users should apply the security update provided by their Linux distribution (e.g., Red Hat, Ubuntu, SUSE) or upgrade to a patched upstream kernel. Systems not using STM32 pin controller hardware are not affected and do not require remediation (Red Hat CVE, Linux Kernel Git).