CVE-2023-54230: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54230 is a reference count (refcount) leak vulnerability in the Linux kernel's AMBA bus driver. The bug was introduced by commit 5de1540b7bc4 ("drivers/amba: create devices from device tree"), which increments the reference count of of_node but fails to release it in amba_device_release, resulting in a memory resource leak. The vulnerability affects multiple stable Linux kernel branches prior to the following patched versions: 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6. It was published on December 30, 2025, and carries an EPSS score of approximately 0.043% (Feedly, ENISA EUVD).

The root cause is a missing of_node_put() call in the amba_device_release function, classified as CWE-401 (Missing Release of Memory after Effective Lifetime) or more broadly as an improper resource management issue. When the AMBA bus driver creates devices from a device tree (via commit 5de1540b7bc4), it calls of_node_get() to increment the reference count of the associated of_node, but the corresponding decrement via of_node_put() is never invoked when the device is released. This causes the of_node object's reference count to never reach zero, preventing proper memory reclamation. The fix applies of_node_put() in amba_device_release to correctly balance the reference count (Feedly, ENISA EUVD).

The primary impact of this vulnerability is a kernel memory resource leak, where of_node objects are never freed after AMBA devices are released. Over time, repeated device creation and removal cycles can exhaust kernel memory, potentially degrading system stability or contributing to denial-of-service conditions on affected systems. There is no known direct path to privilege escalation, code execution, or data exfiltration from this vulnerability; the impact is limited to availability (Feedly).

Apply the upstream kernel patches that introduce of_node_put() in amba_device_release. Fixed versions are available across multiple stable branches: 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6. Users should update to the patched kernel version for their respective stable branch as provided by their Linux distribution. No configuration-based workaround is available; upgrading the kernel is the only remediation (ENISA EUVD, Feedly).