Cloudanix VulnDB

CVE-2023-54259

None

CVSS

—

EPSS

0.2%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in audio-device power handling could cause unexpected crashes or instability on systems using certain sound hardware.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw is an unbalanced pm_runtime_put() after pm_runtime_resume_and_get() returns -EACCES without incrementing the usage count, causing underflow in soundwire bus functions.

Why it matters to the business

Kernel instability or crashes may occur on systems with soundwire audio hardware when power-management errors are encountered, affecting device reliability across Linux deployments.

How an attack unfolds

Local code paths in the soundwire bus invoke pm_runtime_resume_and_get(), receive -EACCES, ignore the error, and unconditionally call pm_runtime_put(), decrementing a count that was never incremented.

How to fix it

Upgrade the Linux kernel to a version containing commit 4e5e9da139c007dfc397a159093b4c4187ee67fa (or the equivalent stable backport) that reverts the faulty pm_runtime_resume_and_get() usage.

How to confirm the fix worked

Confirm the revert commit is present in the running kernel source or verify that pm_runtime_get_sync() calls are restored in the soundwire bus code.

Typical attack path

  1. Reach soundwire bus functions that perform runtime PM
  2. Force or encounter -EACCES from pm_runtime_resume_and_get()
  3. Execute the unconditional pm_runtime_put() at function exit
  4. Trigger usage-count underflow and subsequent kernel warnings or panic

How to detect it

Inspect kernel logs (dmesg, journalctl) for pm_runtime usage-count underflow messages or warnings originating from soundwire bus functions around the time of any observed instability.

What your security team should do

  • Apply the referenced kernel commit or distribution update as soon as packages are available
  • Reboot affected systems after patching to load the corrected soundwire bus module
  • Monitor kernel logs for pm_runtime underflow warnings until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow This reverts commit 443a98e649b4 ("soundwire: bus: use pm_runtime_resume_and_get()") Change calls to pm_runtime_resume_and_get() back to pm_runtime_get_sync(). This fixes a usage count underrun caused by doing a pm_runtime_put() even though pm_runtime_resume_and_get() returned an error. The three affected functions ignore -EACCES error from trying to get pm_runtime, and carry on, including a put at the end of the function. But pm_runtime_resume_and_get() does not increment the usage count if it returns an error. So in the -EACCES case you must not call pm_runtime_put(). The documentation for pm_runtime_get_sync() says: "Consider using pm_runtime_resume_and_get() ... as this is likely to result in cleaner code." In this case I don't think it results in cleaner code because the pm_runtime_put() at the end of the function would have to be conditional on the return value from pm_runtime_resume_and_get() at the top of the function. pm_runtime_get_sync() doesn't have this problem because it always increments the count, so always needs a put. The code can just flow through and do the pm_runtime_put() unconditionally.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.1.30
Linux Kernel 5.19.0 6.1.30

Related vulnerabilities