CVE-2023-54009 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
The cdns_i2c_master_xfer() function gets a runtime PM reference when the function is entered. This reference is released when the function is exited. There is currently one error path where the function exits directly, which leads to a leak of the runtime PM reference.
Make sure that this error path also releases the runtime PM reference.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/30/2026
The vulnerability identified as CVE-2023-54009 represents a runtime power management reference leak within the Linux kernel's I2C subsystem, specifically affecting the Cadence I2C controller driver. This issue resides in the cdns_i2c_master_xfer() function which manages I2C master transfers for Cadence-based hardware controllers. The flaw demonstrates a classic resource management error where the kernel's power management subsystem fails to properly release acquired references during error conditions, creating a potential for system instability and resource exhaustion.
The technical implementation of this vulnerability stems from the improper handling of runtime power management references within the I2C transfer function. When cdns_i2c_master_xfer() is invoked, it correctly acquires a runtime PM reference to ensure the hardware remains powered during the transfer operation. However, during certain error conditions, the function exits directly without properly releasing this acquired reference. This direct exit path bypasses the normal cleanup procedures that would typically release the power management reference, resulting in a reference count leak. The vulnerability specifically affects the error handling path where the function terminates prematurely, leaving the runtime PM subsystem in an inconsistent state where it believes the hardware is still actively in use.
From an operational perspective, this vulnerability poses significant risks to system stability and power management efficiency in embedded systems and devices utilizing Cadence I2C controllers. The runtime PM leak can accumulate over time, particularly in systems with frequent I2C operations or error conditions, leading to gradual depletion of available power management resources. This could manifest as reduced battery life in mobile devices, increased power consumption in embedded systems, or potential system hangs where the power management subsystem becomes unresponsive due to reference count inconsistencies. The impact is particularly concerning in automotive, industrial, and IoT applications where reliable power management is critical for system operation and safety.
The vulnerability aligns with CWE-404, which categorizes improper resource release or cleanup, and specifically relates to improper handling of power management references within kernel subsystems. This flaw demonstrates the importance of proper error path management in kernel code, where all acquisition points must have corresponding release mechanisms regardless of execution flow. Mitigation strategies should focus on ensuring that all code paths through the cdns_i2c_master_xfer() function properly release runtime PM references, either through explicit cleanup in error handling branches or by restructuring the function to ensure consistent reference management. The fix involves modifying the error handling code to include explicit runtime PM reference release operations before function exit, ensuring that power management resources are properly accounted for and released in all execution scenarios. This remediation approach follows established kernel development practices for maintaining power management consistency and preventing resource leaks that could compromise system reliability and performance.