LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54017: powerpc/pseries: fix possible memory leak in ibmebus_bus_init()

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: fix possible memory leak in ibmebus_bus_init() If device_register() returns error in ibmebus_bus_init(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. As comment of device_add() says, it should call put_device() to drop the reference count that was set in device_initialize() when it fails, so the name can be freed in kobject_cleanup().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel issue in the PowerPC pSeries IBM eBus initialization path. If device registration fails, a device name allocation may not be released, causing a memory leak. The source bundle does not show data exposure, privilege escalation, remote code execution, or active exploitation.

Executive priority

Treat as a low-urgency kernel hygiene item unless the environment runs PowerPC pSeries Linux at scale. Prioritize normal patch management and asset validation over emergency response.

Technical view

In ibmebus_bus_init(), an error return from device_register() can leave the kobject name allocated by dev_set_name() unreleased. The fix is to call put_device() on failure so the reference from device_initialize() is dropped and kobject_cleanup() can free the name.

Likely exposure

Exposure appears limited to Linux systems using the affected PowerPC pSeries code path and affected kernel versions listed in the CVE record. Organizations without PowerPC pSeries Linux assets are unlikely to be exposed based on the provided sources.

Exploitation context

CISA KEV is false in the bundle, and no cited source reports active exploitation. The issue is described as a memory leak during an initialization failure path, not as a known remotely exploitable weakness.

Researcher notes

Evidence is narrow: the bundle provides the kernel fix rationale and stable commit references, but no CVSS, CWE, exploit report, or distribution-specific advisory. Avoid expanding impact beyond the stated memory leak unless new vendor analysis appears.

Mitigation direction

  • Identify Linux assets running PowerPC pSeries kernels.
  • Compare deployed kernel versions against the affected versions in the CVE record.
  • Apply the relevant stable kernel update containing the referenced fix.
  • Check Linux distribution advisories for packaged backports and maintenance guidance.

Validation and detection

  • Inventory kernel versions and architecture for Linux hosts.
  • Confirm whether PowerPC pSeries systems use affected kernel branches.
  • Verify the referenced stable fix is present in deployed kernel source or package changelog.
  • Monitor vendor advisories for any revised severity or mitigation guidance.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54017 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888, d7a301033f1990188f65abf4fe8e5b90ef0e3888unaffected
LinuxLinux2.6.16, 0, 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.