CVE-2023-54190

What it actually does

Refcount leak in leds led-core of_led_get() because class_find_device_by_of_node() acquires a device reference via class_find_device() that is never released with put_device().

Why it matters to the business

Kernel memory or reference-count exhaustion can occur on systems that repeatedly enumerate LED devices via device tree, leading to degraded stability or eventual denial of service in embedded or server Linux deployments.

How an attack unfolds

An attacker with local access or the ability to trigger repeated LED device-tree lookups causes the reference leak to accumulate until kernel resources are exhausted or a use-after-free window appears after the leaked objects are eventually freed.

How to fix it

Upgrade the Linux kernel to the commit 1d6101d9222e1ca8c01b3fa9ebf0dcf7bcd82564 or any stable branch that contains the put_device() fix in of_led_get().

How to confirm the fix worked

Confirm the presence of the put_device() call immediately after class_find_device_by_of_node() in drivers/leds/led-core.c and verify the running kernel contains commit 1d6101d9222e1ca8c01b3fa9ebf0dcf7bcd82564.

Typical attack path

1. Obtain local execution or the ability to load modules that interact with LED class devices
2. Trigger of_led_get() paths that call class_find_device_by_of_node() repeatedly
3. Accumulate unreleased device references until memory pressure or reference-count overflow occurs
4. Leverage resulting instability or freed objects for further kernel exploitation

How to detect it

Review kernel logs for repeated LED class device enumeration, monitor slab or kmem_cache usage for led_classdev objects, and inspect call traces involving of_led_get and class_find_device.

What your security team should do

• Apply the referenced upstream commit or newer kernel package immediately on all affected systems
• Prioritize patching on devices that expose LED device-tree nodes to untrusted workloads
• Monitor kernel memory usage and reference-count statistics for anomalous growth in the interim