Linux Kernel up to 6.2.9 ptp_qoriq drivers/ptp/ptp_qoriq.c probe memory leak

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 5.4.239/5.10.176/5.15.105/6.1.22/6.2.9. This affects the function probe of the file drivers/ptp/ptp_qoriq.c of the component ptp_qoriq. This manipulation causes memory leak. This vulnerability is tracked as CVE-2023-54307. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.4.239/5.10.176/5.15.105/6.1.22/6.2.9. It has been declared as critical. Affected by this vulnerability is the function probe of the file drivers/ptp/ptp_qoriq.c of the component ptp_qoriq. The manipulation with an unknown input leads to a memory leak vulnerability. The CWE definition for the vulnerability is CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ptp_qoriq: fix memory leak in probe() Smatch complains that: drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() warn: 'base' from ioremap() not released. Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. This is only a bug if ptp_qoriq_init() returns on the first -ENODEV error path. For other error paths ptp_qoriq->base and base are the same. And this change makes the code more readable.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2023-54307 since 12/30/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 281704 (Linux Distros Unpatched Vulnerability : CVE-2023-54307), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.240, 5.10.177, 5.15.106, 6.1.23 or 6.2.10 eliminates this vulnerability. Applying the patch 46c4993a1514eea3bbc7147d0c81c23cc06c6bed/3907fcb5a439933cf8c10d6dc300bc11eba30de3/c0de1a26e6595b0e7969c5b35990a77a2d93104f/43b4331ce0cd88ccba425e0702ba35c1a52daccf/c960785c8168d0e572101ed921b9be3934ed0bc9/f33642224e38d7e0d59336e10e7b4e370b1c4506 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (281704) and CERT Bund (WID-SEC-2025-2941). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.239
• 5.10.176
• 5.15.105
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion