CVE-2023-54259 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow
This reverts commit 443a98e649b4 ("soundwire: bus: use pm_runtime_resume_and_get()")
Change calls to pm_runtime_resume_and_get() back to pm_runtime_get_sync(). This fixes a usage count underrun caused by doing a pm_runtime_put() even though pm_runtime_resume_and_get() returned an error.
The three affected functions ignore -EACCES error from trying to get pm_runtime, and carry on, including a put at the end of the function. But pm_runtime_resume_and_get() does not increment the usage count if it returns an error. So in the -EACCES case you must not call pm_runtime_put().
The documentation for pm_runtime_get_sync() says: "Consider using pm_runtime_resume_and_get() ... as this is likely to result in cleaner code."
In this case I don't think it results in cleaner code because the pm_runtime_put() at the end of the function would have to be conditional on the return value from pm_runtime_resume_and_get() at the top of the function.
pm_runtime_get_sync() doesn't have this problem because it always increments the count, so always needs a put. The code can just flow through and do the pm_runtime_put() unconditionally.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54259 represents a critical runtime power management issue within the Linux kernel's SoundWire bus subsystem. This flaw manifests as an unbalanced power management runtime reference count operation that can lead to usage count underflow conditions. The vulnerability specifically affects the soundwire bus driver implementation where improper handling of power management runtime operations creates a scenario that can potentially destabilize system operations and compromise device power state management. The issue stems from a problematic code change that reverted a previous optimization attempt, introducing a fundamental flaw in the power management reference counting mechanism.
The technical root cause of this vulnerability lies in the improper handling of power management runtime operations within three specific functions of the SoundWire bus driver. When the code previously used pm_runtime_resume_and_get() function, it correctly handled error conditions including -EACCES errors that indicate access denial. However, this function behaves differently from pm_runtime_get_sync() in error scenarios. The pm_runtime_resume_and_get() function does not increment the usage count when it returns an error, whereas pm_runtime_get_sync() always increments the count regardless of success or failure. This fundamental difference creates a race condition where code paths that ignore -EACCES errors and proceed to execute pm_runtime_put() without proper conditional checks result in underflow conditions.
The operational impact of this vulnerability extends beyond simple power management issues to potentially affect system stability and device functionality. When the usage count underflows, it can cause the power management subsystem to enter an inconsistent state where device power states become unpredictable. This may lead to device failures, system hangs, or unexpected power state transitions that could affect audio quality and overall system reliability. The vulnerability is particularly concerning in embedded systems and mobile devices where SoundWire is commonly used for audio interfaces and device connectivity, as these systems often rely heavily on precise power management for battery optimization and thermal control.
This vulnerability maps directly to CWE-129 and CWE-131 in the Common Weakness Enumeration catalog, representing weaknesses in input validation and improper handling of resource management operations. The issue also aligns with ATT&CK technique T1547.001 (Registry Run Keys/Startup Folder) and T1566.001 (Phishing) in the context of system stability attacks, where improper resource handling can create conditions that make systems more susceptible to exploitation. The fix implemented addresses this by reverting to pm_runtime_get_sync() which provides more predictable behavior through unconditional reference counting. This approach eliminates the conditional logic complexity that was causing the underflow issue and ensures that every successful pm_runtime_get_sync() call is properly matched with a corresponding pm_runtime_put() operation.
The mitigation strategy involves maintaining the use of pm_runtime_get_sync() throughout the affected functions, ensuring that all power management operations follow a consistent pattern where the usage count is always incremented and subsequently decremented. This approach aligns with the kernel documentation's recommendation to use pm_runtime_get_sync() when cleaner code cannot be achieved with pm_runtime_resume_and_get() due to the complexity of conditional reference counting. The fix essentially restores the original behavior that was more robust despite being less elegant in code structure, demonstrating the principle that sometimes simpler implementations are more secure and reliable than overly optimized code that introduces subtle race conditions and reference counting errors. System administrators and kernel developers should verify that all SoundWire-related subsystems are updated to this corrected implementation to prevent potential system instability or device malfunction.