CVE-2023-54297: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54297 is a memory leak vulnerability in the Linux kernel's Btrfs zoned filesystem subsystem. Specifically, within the exclude_super_stripes() function, when a block group containing super blocks is encountered on a zoned filesystem — an invalid condition indicating a potential bug or memory corruption — the function exits with an error without freeing the memory allocated for the logical address of the super blocks. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from 5.11 up to the patched releases (5.15.123, 6.1.42, 6.4.7, and 6.5). The EPSS score is approximately 0.018% (very low), and no CVSS score has been publicly assigned (Feedly, EUVD).

The root cause is a missing memory deallocation on an error code path in the Btrfs zoned filesystem's exclude_super_stripes() function (CWE-401: Missing Release of Memory after Effective Lifetime). When the function detects a block group with super blocks mapped to it on a zoned device — which should never occur — it returns an error but fails to call kfree() on the buffer allocated for the logical super block addresses. This is a local, kernel-space issue triggered during filesystem mount or block group processing, requiring the system to be using a Btrfs zoned filesystem configuration. Fixes were applied across four stable kernel branches via commits f1a07c2b, cca627af, c35ea606, and ab80a901 (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which over time can degrade system stability and availability by exhausting kernel memory resources. It does not directly enable privilege escalation, remote code execution, or data exfiltration. The vulnerability is limited to systems running Linux with Btrfs on zoned block devices (e.g., SMR hard drives or NVMe ZNS devices), narrowing the affected asset scope considerably (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Users should upgrade to kernel version 5.15.123 or later (for the 5.15.x series), 6.1.42 or later (for the 6.1.x series), 6.4.7 or later (for the 6.4.x series), or 6.5 or later. The relevant upstream commits are f1a07c2b, cca627af, c35ea606, and ab80a901. As a workaround, systems not using Btrfs on zoned block devices are not affected and require no immediate action (EUVD, Feedly).