CVE-2023-54036

What it actually does

Memory leaks occur in the rtl8xxxu driver when C2H messages from RTL8723BU and RTL8192EU chips are not freed, due to missing dev_kfree_skb calls inside skb_dequeue loops and bypassed processing for certain rf_paths configurations.

Why it matters to the business

Affected Linux systems with these wifi+bluetooth chips may experience gradual memory exhaustion during Bluetooth audio or high-traffic use, leading to performance degradation, instability, or crashes that disrupt wireless operations and require reboots.

How an attack unfolds

An attacker or benign user triggers repeated C2H message generation via Bluetooth connections and traffic on RTL8723BU or RTL8192EU hardware; the driver enqueues messages without freeing them, consuming kernel memory over time until the system is impacted.

How to fix it

Update to Linux kernel commit 430f9f9bec53a75f9ccc53e156a66f13fc098b83 or later; for nvidia-gpu-operator-validator-24.3 use version 24.3.0-r13 or newer that incorporates the fix.

How to confirm the fix worked

Confirm the fix commit is present in the rtl8xxxu source tree or verify updated driver binary no longer exhibits leaks under Bluetooth load testing.

Typical attack path

1. Establish Bluetooth connection to affected RTL8723BU or RTL8192EU hardware
2. Generate high-volume C2H traffic such as audio streams
3. Driver fails to free skb buffers in rtl8xxxu_c2hcmd_callback or skips processing for RTL8192EU
4. Kernel memory usage increases unboundedly

How to detect it

Review kernel logs and memory profiling for rtl8xxxu C2H skb allocations without matching frees; inspect driver source or runtime behavior under Bluetooth load for unprocessed queue entries.

What your security team should do

• Apply kernel updates immediately on systems using RTL8723BU or RTL8192EU chips due to published fix availability
• Monitor memory usage trends on affected wireless hardware
• Test Bluetooth functionality post-update to ensure C2H handling is corrected