CVE-2023-54230

What it actually does

The vulnerability is a reference count leak on an of_node object in the AMBA bus driver; amba_device_release fails to call of_node_put after the node was acquired during device creation from device tree, leaving the reference permanently elevated.

Why it matters to the business

Linux-based embedded and server systems may experience gradual memory exhaustion or unexpected kernel object lifetime issues, potentially leading to instability or degraded performance over time on affected kernels.

How an attack unfolds

An attacker with the ability to trigger repeated creation and release of AMBA devices (for example through device tree manipulations or driver load/unload sequences) can cause the kernel to retain references indefinitely; the leak itself does not provide direct code execution but can be combined with other kernel bugs to influence memory layout or resource availability.

How to fix it

Upgrade the Linux kernel to the commit 94e398df32e850f26828690ee62f7441979583cc or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Verify that the running kernel contains commit 94e398df32e850f26828690ee62f7441979583cc, inspect the amba_device_release function for the presence of of_node_put on the of_node field, and confirm no refcount warnings appear in kernel logs during device hotplug or driver unload cycles.

Typical attack path

1. Identify a system running an unpatched Linux kernel containing the AMBA bus driver
2. Trigger repeated allocation paths that invoke amba_device creation from device tree
3. Allow the kernel to execute amba_device_release without the missing of_node_put
4. Accumulate leaked references until memory pressure or object lifetime side-effects appear

How to detect it

Review kernel logs for repeated amba or of_node refcount imbalance messages, monitor slab or kmem_cache statistics for unexpected growth in device-tree related objects, and examine any crash dumps that reference amba_device_release.

What your security team should do

• Prioritize kernel upgrades on internet-facing and high-value Linux hosts within the published remediation window
• Include the fixed commit hash in automated patch scanning and SBOM validation pipelines
• Monitor kernel memory and refcount-related warnings in production fleets until all nodes are updated