CVE-2023-54307: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54307 is a memory leak vulnerability in the Linux kernel's ptp_qoriq driver, specifically within the ptp_qoriq_probe() function. The bug occurs when ptp_qoriq_init() returns on the first -ENODEV error path, causing the base pointer obtained from ioremap() to not be released. It affects Linux kernel versions from 5.2 up to the patched stable releases (5.4.240, 5.10.177, 5.15.106, 6.1.23, 6.2.10, and 6.3). The vulnerability was published on December 30, 2025, and carries an EPSS score of approximately 0.024% (very low), with no CVSS base score assigned (Feedly, EUVD).

The root cause is a missing iounmap() call on the base pointer returned by ioremap() in the ptp_qoriq_probe() function of drivers/ptp/ptp_qoriq.c (CWE-401: Missing Release of Memory after Effective Lifetime). Specifically, when ptp_qoriq_init() encounters the first -ENODEV error path, the local base variable is not freed because the error-handling code incorrectly references ptp_qoriq->base (which has not yet been assigned) instead of base. The fix changes the iounmap() call to use the local base variable, ensuring the mapped memory is always released on error. This was identified by the Smatch static analysis tool (Feedly, Kernel Commit).

The vulnerability results in a kernel memory leak when the ptp_qoriq PTP (Precision Time Protocol) driver fails to initialize on NXP QorIQ-based hardware. The leaked memory is limited to the ioremap()-mapped I/O region and does not directly expose sensitive data or allow privilege escalation. The primary impact is on availability — repeated probe failures (e.g., during module reload cycles) could gradually exhaust kernel memory resources, potentially degrading system stability on affected embedded or networking hardware (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54307. The vulnerability is a local kernel memory leak triggered only under specific driver error conditions on NXP QorIQ hardware, making it extremely difficult to weaponize for meaningful attack impact. The EPSS score is approximately 0.024%, reflecting very low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should upgrade to the following patched versions or later: 5.4.240, 5.10.177, 5.15.106, 6.1.23, 6.2.10, or 6.3. The fix is contained in commits 46c4993a, 3907fcb5, c0de1a26, 43b4331c, c960785c, and f3364222 across the respective stable trees. Systems not using NXP QorIQ hardware or the ptp_qoriq driver are not affected (Feedly, EUVD).