LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54055: RDMA/irdma: Fix memory leak of PBLE objects

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time unlike other HMC objects. PBLEs objects and the Segment Descriptors (SD) for it can be dynamically allocated during scale up and SD's remain allocated till function deinitialization. Fix this leak by adding IRDMA_HMC_IW_PBLE to the iw_hmc_obj_types[] table and skip pbles in irdma_create_hmc_obj but not in irdma_del_hmc_objects().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel irdma driver memory leak. When the irdma module is removed, PBLE-related memory may not be freed. The public record does not provide CVSS, CWE, or confirmed impact beyond the leak, so urgency depends on whether affected systems use this driver.

Executive priority

Treat as targeted patch hygiene rather than an emergency unless irdma is broadly used in critical infrastructure. Prioritize affected RDMA-capable Linux hosts and confirm vendor-fixed kernels during normal maintenance windows.

Technical view

The flaw is in Linux RDMA/irdma HMC object cleanup. PBLE objects and their segment descriptors can be dynamically allocated during scale-up, but PBLE memory was omitted from deletion handling during irdma deinitialization. The fix adds IRDMA_HMC_IW_PBLE to cleanup object tracking while skipping PBLE creation in create handling.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the irdma RDMA driver in use. The source data lists affected Linux kernel ranges and stable commit references, but no distribution package mapping or hardware inventory criteria.

Exploitation context

No active exploitation is supported by the provided sources. The CVE is not marked KEV, and the bundle provides no public exploit evidence. The issue is described as a memory leak during module removal, not a remote code execution flaw.

Researcher notes

The evidence is narrow: a kernel memory leak fixed by stable commits, with no CVSS, CWE, exploit status, or distribution advisories in the bundle. Validate by code lineage and vendor backport status rather than assuming all Linux hosts are exposed.

Mitigation direction

  • Apply kernel updates or distribution backports that include the referenced stable fixes.
  • Check Linux distribution advisories for exact affected package versions.
  • If patching is delayed, follow vendor guidance for irdma/RDMA risk reduction.
  • Track systems where the irdma module is loaded or operationally required.

Validation and detection

  • Inventory Linux kernel versions against the affected ranges in the CVE record.
  • Identify systems with the irdma driver present, loaded, or used for RDMA.
  • Confirm installed kernels include one of the referenced stable fixes or vendor backports.
  • Review vendor advisories because the CVE record lacks CVSS and package-level detail.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54055 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux44d9e52977a1b90b0db1c7f8b197c218e9226520, 44d9e52977a1b90b0db1c7f8b197c218e9226520, 44d9e52977a1b90b0db1c7f8b197c218e9226520, 44d9e52977a1b90b0db1c7f8b197c218e9226520unaffected
LinuxLinux5.14, 0, 5.15.108, 6.1.25, 6.2.12, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.