CVE-2023-54009

What it actually does

The cdns_i2c_master_xfer() function in the Linux kernel I2C Cadence driver acquires a runtime PM reference on entry but fails to release it on one error path, causing a reference leak.

Why it matters to the business

Systems using the affected Cadence I2C controller may experience gradual resource exhaustion or improper power management behavior over time, increasing operational overhead especially in embedded or always-on deployments; the issue affects certain packaged Linux distributions and dependent projects.

How an attack unfolds

An attacker would need local access to trigger repeated I2C transfers that hit the error path in cdns_i2c_master_xfer(), accumulating leaked runtime PM references until system resources are impacted; no public exploitation or threat actor campaigns are known.

How to fix it

Update to a fixed kernel containing commit fd7bf900c3215c77f6d779d1532faa22b79f2430 or later; for kubernetes-replicator packages use version 2.11.1-r4 or newer from the respective Chainguard or Wolfi repositories.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or package version 2.11.1-r4; review driver source for the added put_sync call on the previously leaking error path.

Typical attack path

1. Obtain local code execution or user access on a system with the Cadence I2C driver loaded
2. Trigger I2C master transfers that exercise the error exit path inside cdns_i2c_master_xfer()
3. Repeat the triggering condition to accumulate leaked runtime PM references
4. Observe gradual degradation in power management or resource availability

How to detect it

Search kernel logs and driver traces for repeated entries around cdns_i2c_master_xfer error handling; monitor runtime PM reference counts via kernel debug interfaces on affected hardware.

What your security team should do

• Prioritize patching Linux kernels and dependent packages on systems using Cadence I2C hardware
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Apply updates within standard maintenance windows given the low EPSS and absence from KEV