CVE-2023-54017

What it actually does

Failure to invoke put_device() after device_register() error in ibmebus_bus_init() leaks the kobject name allocated by dev_set_name(), preventing kobject_cleanup() from releasing the memory.

Why it matters to the business

Long-running powerpc pseries systems may gradually exhaust kernel memory, leading to degraded performance or denial of service after repeated initialization failures.

How an attack unfolds

An attacker with local access triggers repeated device registration failures in the ibmebus subsystem; each failure leaks a small amount of kernel memory that accumulates until the system becomes unstable.

How to fix it

Update the Linux kernel to commit e4ff88548defafb1ef84facd9856ec252da7b008 or later; rebuild and reboot affected systems. For packaged distributions use go-bindata 3.1.3-r27 or newer.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source; verify that device_register() error paths now call put_device() before returning.

Typical attack path

1. Obtain local access on a vulnerable powerpc pseries system
2. Cause repeated failures in ibmebus_bus_init() device registration
3. Accumulate leaked kobject names until memory pressure triggers DoS

How to detect it

Review kernel logs around ibmebus initialization for repeated device_register failures; inspect slab or kmemleak reports for orphaned kobject names originating from device_add.

What your security team should do

• Prioritize patching powerpc pseries kernels within the next maintenance window
• Monitor kernel memory usage on affected systems for unexplained growth
• Apply the exact fixed commit or package version listed for each distribution