CVE-2023-54221: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54221 is a memory leak and missing unwind goto vulnerability in the Linux kernel's i.MX93 clock driver (clk: imx93). The flaw exists in the imx93_clocks_probe() function, which fails to properly unregister hardware clock entries and free allocated memory when an error occurs during probe. It affects Linux kernel versions starting from the introduction of the i.MX93 clock driver (around 5.18) up to the patched stable releases. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, VulDB).

The root cause is a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in drivers/clk/imx/clk-imx93.c. When imx93_clocks_probe() encounters an error at specific points (lines 295 and 310 in the affected code), it returns directly instead of jumping to the unregister_hws cleanup label, leaving hardware clock entries registered and kernel memory allocated via kzalloc() unreleased. Additionally, of_iomap() was used instead of the device-managed devm_of_iomap(), meaning the ioremap region was not automatically released on error. The fix involves adding goto unregister_hws; at the relevant error paths, replacing kzalloc() with devm_kzalloc(), and replacing of_iomap() with devm_of_iomap() (Feedly, Kernel Patch 1).

The primary impact is a kernel memory leak and resource leak triggered during device probe on systems using the NXP i.MX93 SoC. If the clock driver probe fails under certain conditions, kernel memory and I/O mapped regions are not freed, potentially degrading system stability over time or across repeated probe attempts. This vulnerability does not directly enable remote code execution or privilege escalation; its impact is limited to availability (system resource exhaustion) on affected embedded Linux platforms using the i.MX93 clock subsystem (Feedly).

The Linux kernel stable trees have been patched across multiple stable branches. Fixed commits include 280a5ff665e12d1e0c54c20cedc9c5008aa686a5 (6.1.x), d17c16a2b2a6589c45b0bfb1b9914da80b72d89e (6.3.x → 6.3.13), e02ba11b457647050cb16e7cad16cec3c252fade (6.4.x → 6.4.4), and fac9c624138c4bc021d7a8ee3b974c9e10926d92 (6.5). Users running i.MX93-based Linux systems should update to kernel versions 6.1.39, 6.3.13, 6.4.4, or 6.5 and later. No configuration-based workaround is available; upgrading to a patched kernel is the recommended remediation (Feedly, Kernel Patch 1).