CVE-2023-54208: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54208 is a memory leak (kernel memleak) vulnerability in the Linux kernel's media subsystem, specifically in the OV5675 image sensor driver (media/i2c/ov5675.c). The flaw exists in the ov5675_init_controls() function, which fails to properly release all allocated resources when an error occurs during initialization. It was published on December 30, 2025, and affects the Linux kernel across multiple stable branches. The CVSS category is estimated as Medium, with an EPSS score of 0.000240 (Feedly, VulDB).

The root cause is a missing cleanup path in ov5675_init_controls() — classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the function encounters an error after v4l2_ctrl_handler_init_class() allocates memory via kvmalloc_node, it does not call the appropriate handler free routine, leaving the allocated 16-byte object unreferenced. The leak was detected using a BPF mock device during testing, with the kmemleak tracer identifying the unreferenced object at address 0xffff888107362160. The fix involves adding proper error-path cleanup to ensure v4l2_ctrl_handler_free() is called on failure (Feedly). Patches are referenced in multiple stable kernel commits (Kernel Git 1, Kernel Git 2).

The vulnerability results in a kernel memory leak each time the OV5675 camera sensor driver fails to initialize correctly, gradually consuming kernel memory without releasing it. Over time, repeated probe failures could degrade system availability by exhausting kernel memory resources, potentially leading to system instability or denial of service on affected embedded or IoT devices using this sensor. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

Apply the upstream Linux kernel patches that fix the missing cleanup in ov5675_init_controls(). Fixes have been committed to multiple stable kernel branches, referenced by commits 7a36a6be694d, 49b849824b98, 086a80b842bc, ba54908ae822, and bcae9115a163 on kernel.org. Users running affected kernel versions with OV5675 camera hardware should update to a patched stable kernel release. As a workaround, systems that do not use the OV5675 sensor can blacklist or unload the ov5675 kernel module to prevent the leaking code path from executing (Kernel Git 1, Kernel Git 2).