CVE-2023-54252 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings
My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54252 represents a memory leak issue discovered within the Linux kernel's platform/x86/think-lmi subsystem, specifically affecting ThinkStation WMI string parsing functionality. This flaw resides in the kernel's handling of hardware-specific management interfaces used by Lenovo ThinkStation workstations, where the system communicates with embedded firmware through Windows Management Instrumentation (WMI) protocols. The vulnerability stems from improper memory management during the processing of configuration settings retrieved from these hardware interfaces, creating a persistent resource consumption issue that can degrade system performance over time.
The technical root cause of this memory leak manifests in the tlmi_setting variable handling within the WMI string parsing function, where allocated memory structures are not properly released after use. This represents a classic CWE-401: Improper Release of Memory Before Removing Last Reference vulnerability, where dynamic memory allocation occurs without corresponding deallocation, leading to gradual memory exhaustion. The flaw was introduced in a previous code revision and specifically affects the think-lmi driver component that manages Lenovo ThinkStation hardware configuration through kernel-space interfaces. The memory leak occurs during the parsing of WMI strings returned by the embedded firmware, where each parsed item consumes kernel memory that remains unreleased until system reboot.
The operational impact of this vulnerability extends beyond simple resource consumption, as persistent memory leaks can lead to system instability, reduced performance, and potential denial of service conditions in environments where these ThinkStation systems operate continuously. Attackers could potentially exploit this weakness to consume system resources over time, particularly in server or workstation environments where WMI string parsing operations occur frequently. The vulnerability affects systems running Linux kernels with the think-lmi driver enabled, typically found in enterprise environments using Lenovo ThinkStation hardware. From an attack surface perspective, this issue aligns with ATT&CK technique T1070.004: File Deletion, where improper resource management can create conditions that facilitate further exploitation through resource exhaustion attacks.
Mitigation strategies for this vulnerability require immediate kernel updates that apply the fix addressing the memory leak in the tlmi_setting variable handling. System administrators should prioritize patching affected systems, particularly those running enterprise workloads where continuous operation is critical. The fix implements proper memory deallocation before variable reuse and includes renaming the variable to prevent confusion with similarly named variables in the same function, addressing both the immediate leak and potential future introduction of similar issues. Organizations should also implement monitoring for unusual memory consumption patterns that could indicate the presence of this vulnerability in unpatched systems, as the memory leak may not be immediately apparent but can accumulate over extended periods of system operation.