CVE-2023-54123 — Missing Release of Resource after Effective Lifetime in Linux

CWE-772 — Missing Release of Resource after Effective Lifetime7 documents6 sources
Severity
5.5MEDIUM
No vector
EPSS
0.0%
top 89.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedDec 24

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'conf' need be freed, however, 'conf->bio_split' is missed and memory will be leaked. Since there are 3 places to free 'conf', factor out a helper to fix the problem.

Affected Packages4 packages

▶Linuxlinux/linux_kernel4.12.0 — 4.19.283+6
▶Debianlinux/linux_kernel< 5.10.191-1+3
▶CVEListV5linux/linuxfc9977dd069e4f82fcacb262652117c488647319 — 133008af833b4f2e021d2c294c29c70364a3f0ba+8
▶debiandebian/linux< linux 6.1.37-1 (bookworm)

🔴Vulnerability Details

3
OSV
CVE-2023-54123: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'c↗2025-12-24
▶
GHSA
GHSA-fggm-fgvr-h4xg: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(),↗2025-12-24
▶
OSV
md/raid10: fix memleak for 'conf->bio_split'↗2025-12-24
▶

📋Vendor Advisories

2
Red Hat
kernel: Kernel: Denial of Service due to memory leak in RAID10 functionality↗2025-12-24
▶
Debian
CVE-2023-54123: linux - In the Linux kernel, the following vulnerability has been resolved: md/raid10: ...↗2023
▶

🕵️Threat Intelligence

1
Wiz
CVE-2023-54123 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶