CVE-2023-54255: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54255 is a kernel panic vulnerability in the Linux kernel's SuperH (SH) DMA subsystem caused by incorrect DMA channel offset calculations. It affects SoCs of the SH3, SH4, and SH4A family that use the sh/dma driver, where differing numbers of DMA channels distributed across up to two DMAC modules are not correctly handled. The vulnerability was published on December 30, 2025, and has a CVSS base score of 0.0 as assessed by ENISA (no severity rating assigned), with an EPSS score of 0.00032 (Feedly, ENISA EUVD).

The root cause is an improper calculation in dma_base_addr(), which fails to correctly compute channel offsets when DMA channels are distributed between two DMAC modules on SH3/SH4/SH4A SoCs (CWE-682: Incorrect Calculation). Additionally, dmaor_read_reg() and dmaor_write_reg() incorrectly select the DMAC module base for the DMAOR register, compounding the miscalculation. The fix rewrites dma_base_addr() and corrects the DMAC module base selection logic in the register access functions. The vulnerability is local in nature, requiring the affected hardware platform to trigger the faulty code path, which results in a kernel panic (Feedly).

Exploitation of this vulnerability leads to a kernel panic (system crash), resulting in a complete loss of availability for systems running affected SH3/SH4/SH4A-based hardware. There is no known confidentiality or integrity impact, and the scope is limited to the local system. Lateral movement or data exfiltration are not associated with this vulnerability given its nature as a crash-inducing calculation error (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.4.4, and 6.5. Users running SH3/SH4/SH4A-based systems should update to a patched kernel version. The relevant upstream commits are available in the Linux stable kernel repository (Feedly).