CVE-2023-54020

What it actually does

Unconditional allocation of DMA descriptors in sf_pdma_prep_dma_memcpy without matching deallocation in sf_pdma_free_desc causes a memory leak on every call, leading to gradual kernel memory exhaustion.

Why it matters to the business

Affected Linux systems may suffer performance degradation, service interruptions, or crashes from memory starvation during prolonged DMA operations, increasing operational risk on devices using the sf-pdma engine.

How an attack unfolds

An attacker triggers repeated DMA memory copy operations through local workloads or crafted processes, causing descriptor allocations to accumulate without reuse or free, exhausting available memory over time.

How to fix it

Upgrade the Linux kernel to version 5.15.99 or apply the fix adding kfree to sf_pdma_free_desc; for packaged distributions use wait-for-port 1.0.8-r7 or later.

How to confirm the fix worked

Confirm kernel version meets or exceeds 5.15.99; run kmemleak or slabinfo checks to verify no unreferenced sf_pdma_desc objects accumulate after DMA activity.

Typical attack path

1. Obtain local execution context on an affected kernel
2. Invoke or trigger DMA memcpy preparation repeatedly via user-space or driver interfaces
3. Allow the leak to accumulate until memory pressure causes observable system impact

How to detect it

Inspect kmemleak reports and dmesg for unreferenced sf_pdma_desc allocations; correlate with processes invoking DMA memcpy to identify abnormal memory growth patterns.

• sf_pdma_prep_dma_memcpy+0x40/0x112
• unreferenced object.*size 192.*sf_pdma
• kmem_cache_alloc.*sf_pdma_prep_dma_memcpy

What your security team should do

• Apply kernel updates to 5.15.99 or newer on all affected systems without delay
• Enable kernel memory leak detectors in test and production environments
• Monitor memory usage trends on systems with sf-pdma DMA channels