CVE-2023-54020 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: sf-pdma: pdma_desc memory leak fix
Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally allocate a new sf_pdma_desc each time it is called.
The driver previously recycled descs, by checking the in_use flag, only allocating additional descs if the existing one was in use. This logic was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), but sf_pdma_free_desc() was not changed to handle the new behaviour.
As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous descriptor is leaked, over time leading to memory starvation:
unreferenced object 0xffffffe008447300 (size 192): comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) hex dump (first 32 bytes): 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. backtrace: [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28
[<00000000018927a7>] kmem_cache_alloc+0x11e/0x178
[<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112
Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant in_use flag.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/28/2025
The vulnerability CVE-2023-54020 represents a memory leak in the Linux kernel's sf-pdma DMA engine driver that stems from improper resource management within the descriptor allocation and deallocation mechanisms. This issue specifically affects systems utilizing the Microchip MCHP DSC DMA controller and demonstrates a classic case of memory management failure in kernel-space drivers. The flaw manifests when the driver fails to properly release previously allocated memory descriptors, leading to progressive memory consumption that can ultimately result in system instability or resource exhaustion.
The root cause of this vulnerability lies in a code change introduced in commit b2cc5c465c2c that aimed to add multithread support for DMA channels. This modification fundamentally altered the driver's descriptor handling behavior by removing the logic that previously recycled existing descriptors when they were not in use. The driver's previous implementation maintained an in_use flag to track descriptor utilization and would only allocate new descriptors when existing ones were actively being used, thereby conserving memory resources through reuse. However, the introduction of multithreading support necessitated a change in allocation strategy, yet the corresponding cleanup function was not updated to reflect this new behavior.
The technical flaw creates a direct memory leak pattern where each invocation of sf_pdma_prep_dma_memcpy() results in the loss of the previous descriptor's memory without proper deallocation. This occurs because the sf_pdma_free_desc() function was not modified to handle the new allocation paradigm, leaving the kfree() call that would normally release the memory descriptor to be omitted. The memory leak compounds over time as the driver continues to process DMA operations, with each call creating a new descriptor while the old one remains unreferenced and unreleased. The kernel's memory leak detection system (kmemleak) provides detailed diagnostic information showing the leaked object's size, allocation context, and backtrace pointing directly to the problematic function.
The operational impact of this vulnerability extends beyond simple memory consumption issues to potentially compromise system stability and performance. As memory becomes increasingly fragmented and consumed by unreleased descriptors, the system may experience degraded performance, increased latency in DMA operations, or even complete system hangs if memory starvation occurs. This vulnerability particularly affects embedded systems and devices that rely heavily on DMA operations for data transfer, such as network interfaces, storage controllers, or multimedia processing units. The leak affects all systems running the affected kernel version where the sf-pdma driver is active, making it a widespread concern for Linux-based embedded and IoT deployments.
Mitigation strategies for this vulnerability require immediate kernel updates that implement the proper fix by adding the missing kfree() call to sf_pdma_free_desc() and removing the redundant in_use flag that no longer serves a functional purpose. System administrators should prioritize applying the patched kernel version to affected systems, particularly those in production environments where memory resources are critical. Additionally, monitoring for memory leaks in systems using the sf-pdma driver can help detect early signs of this vulnerability, though the primary solution remains the kernel patch. This vulnerability aligns with CWE-401, which specifically addresses improper deallocation of memory, and demonstrates how seemingly isolated changes to driver behavior can create cascading effects that compromise system resource management. The fix addresses the underlying issue by ensuring proper resource lifecycle management in accordance with established kernel memory management practices and prevents the accumulation of unreferenced memory objects that could lead to system instability.