CVE-2023-54259: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54259 is a Linux kernel vulnerability in the SoundWire bus subsystem caused by an unbalanced pm_runtime_put() call leading to a usage count underflow. The flaw was introduced by commit 443a98e649b4 which switched from pm_runtime_get_sync() to pm_runtime_resume_and_get() without accounting for the latter's behavior of not incrementing the usage count on error. It affects the Linux kernel across multiple stable branches, with patches applied in versions 6.1.30, 6.3.4, and 6.4. The vulnerability was publicly disclosed on December 30, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper resource management issue (CWE-911 / improper reference counting) in the soundwire/bus.c driver. Three affected functions in the SoundWire bus subsystem ignore the -EACCES error returned by pm_runtime_resume_and_get() and proceed to call pm_runtime_put() unconditionally at the end of the function. Because pm_runtime_resume_and_get() does not increment the runtime PM usage count when it returns an error, the subsequent unconditional pm_runtime_put() decrements the count below zero, causing a usage count underflow. The fix reverts to pm_runtime_get_sync(), which always increments the count regardless of error state, making the unconditional pm_runtime_put() safe (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a runtime PM usage count underflow in the Linux kernel's SoundWire bus subsystem, which can lead to denial of service through system instability or kernel crashes. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The scope is local to the affected system, and there is no known potential for lateral movement or data exfiltration (Red Hat Advisory).

The fix is available in upstream Linux kernel stable releases: version 6.1.30 (commit 4e5e9da139c0), 6.3.4 (commit 203aa4374c43), and 6.4 (commit e9537962519e). Users should update to a patched kernel version as soon as possible. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat Bugzilla).