CVE-2023-54205

What it actually does

A missing of_node_put() call after of_irq_find_parent() in stm32_pctrl_get_irq_domain causes a device tree node reference count leak in the Linux kernel pinctrl driver.

Why it matters to the business

Repeated IRQ domain operations on STM32-based systems can gradually exhaust kernel memory, leading to performance degradation or crashes on affected Linux devices over extended uptime.

How an attack unfolds

An attacker with local access triggers repeated calls to the affected pinctrl IRQ lookup path to accelerate the reference count leak; no public exploits or threat actor campaigns are associated with this issue.

How to fix it

Update the Linux kernel to a fixed version containing commit 95ab6d7905ebb52dc2ed6357c38e536753824068 (or the equivalent stable backport) for all affected branches.

How to confirm the fix worked

Inspect the stm32_pctrl_get_irq_domain function in the pinctrl/stm32 source to confirm of_node_put() is called after of_irq_find_parent(), and verify the commit is present in the running kernel.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Repeatedly invoke operations that call stm32_pctrl_get_irq_domain
3. Accelerate kernel memory depletion through sustained triggering

How to detect it

Use kernel memory leak detectors such as kmemleak or monitor for sustained increases in device tree node references during pinctrl IRQ operations; review dmesg for related warnings.

What your security team should do

• Apply the referenced kernel commit immediately on all STM32-based deployments
• Monitor kernel memory statistics for unusual growth on affected hardware
• Prioritize patching given the broad Linux kernel ecosystem prevalence