LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54072: ALSA: pcm: Fix potential data race at PCM memory allocation helpers

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed without a proper lock and the allocation isn't serialized; this allows user to allocate more memories than predefined max size. Practically seen, this isn't really a big problem, as it's more or less some "soft limit" as a sanity check, and it's not possible to allocate unlimitedly. But it's still better to address this for more consistent behavior. The patch covers the size check in do_alloc_pages() with the card->memory_mutex, and increases the allocated size there for preventing the further overflow. When the actual allocation fails, the size is decreased accordingly.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2023-54072 is a Linux kernel ALSA PCM memory accounting race. A user could exceed a predefined PCM buffer memory limit because allocation checks were not properly locked. The source describes this as a consistency issue around a soft limit, not unlimited memory allocation.

Executive priority

Treat as routine kernel hygiene unless affected systems expose audio interfaces to untrusted local users. Prioritize through normal Linux patch cycles, with faster handling for shared workstations, multimedia systems, or multi-user environments.

Technical view

The flaw is in Linux ALSA PCM memory allocation helpers. The size check against excessive buffer allocations ran without proper serialization, allowing concurrent allocations to bypass the intended accounting limit. Stable fixes wrap the check and accounting update with card->memory_mutex and roll back accounting if allocation fails.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds with ALSA PCM interfaces available to users or workloads. The CVE record lists Linux kernel version entries including 5.6, 5.10.193, 5.15.129, 6.1.39, 6.4.4, and 6.5.

Exploitation context

No cited source reports active exploitation, and the CVE is not marked KEV. The public description says the practical impact is limited because the affected limit is a sanity check and unlimited allocation is not possible.

Researcher notes

The evidence supports a race in memory accounting rather than a direct privilege escalation or remote vector. The source bundle provides no CVSS, CWE, exploit report, or distribution-specific fixed versions, so validation should focus on kernel provenance and stable commit inclusion.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the ALSA PCM allocation helper fix.
  • For custom kernels, review and include the referenced stable kernel commits.
  • Check Linux vendor advisories for exact fixed package versions.
  • Limit untrusted access to ALSA PCM devices where practical until patched.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, appliances, and images.
  • Confirm whether ALSA PCM support is present and exposed to users or workloads.
  • Verify patched kernels include one of the referenced stable fixes.
  • Track distribution security advisories for package-specific remediation status.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54072 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux95b30a4312545f2dde9db12bf6a425f35d5a0d77, d4cfb30fce03093ad944e0b44bd8f40bdad5330e, d4cfb30fce03093ad944e0b44bd8f40bdad5330e, d4cfb30fce03093ad944e0b44bd8f40bdad5330e, d4cfb30fce03093ad944e0b44bd8f40bdad5330e, d4cfb30fce03093ad944e0b44bd8f40bdad5330eunaffected
LinuxLinux5.6, 0, 5.10.193, 5.15.129, 6.1.39, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.