CVE-2023-54097

What it actually does

Memory leak in stm32_pwr_regulator_probe where an iomap address obtained via of_iomap is not released when devm_kzalloc or devm_regulator_register fails.

Why it matters to the business

On systems using the STM32 PWR regulator driver, repeated probe failures can slowly exhaust kernel memory and contribute to instability, though overall risk remains low given the narrow hardware scope and lack of known exploitation.

How an attack unfolds

An attacker would need to induce repeated probe failures for the stm32-pwr device on affected embedded hardware; no remote or unauthenticated paths exist and no threat actors have been observed using the issue.

How to fix it

Update the Linux kernel to a version containing commit 824683dbec234a01bd49a0589ee3323594a6f4cf, which replaces of_iomap with devm_platform_ioremap_resource in drivers/regulator/stm32-pwr.c.

How to confirm the fix worked

Confirm the commit 824683dbec234a01bd49a0589ee3323594a6f4cf (or equivalent backport) is present in the kernel tree and that devm_platform_ioremap_resource is used instead of of_iomap in the stm32-pwr driver.

Typical attack path

1. Gain ability to trigger device probe or module reload on STM32-based hardware
2. Force allocation or registration failures inside stm32_pwr_regulator_probe
3. Repeat the failure condition to accumulate unreleased iomap mappings

How to detect it

Examine kernel logs for repeated stm32_pwr_regulator_probe failures and monitor memory usage trends on STM32 platforms; no post-exploitation artifacts are known.

What your security team should do

• Apply the kernel update containing the referenced commit at the earliest maintenance window
• Prioritize patching on STM32-based embedded or industrial devices where the regulator driver is active
• Re-test device bring-up after the update to ensure probe paths succeed