LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54097: regulator: stm32-pwr: fix of_iomap leak

In the Linux kernel, the following vulnerability has been resolved: regulator: stm32-pwr: fix of_iomap leak Smatch reports: drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: 'base' from of_iomap() not released on lines: 151,166. In stm32_pwr_regulator_probe(), base is not released when devm_kzalloc() fails to allocate memory or devm_regulator_register() fails to register a new regulator device, which may cause a leak. To fix this issue, replace of_iomap() with devm_platform_ioremap_resource(). devm_platform_ioremap_resource() is a specialized function for platform devices. It allows 'base' to be automatically released whether the probe function succeeds or fails. Besides, use IS_ERR(base) instead of !base as the return value of devm_platform_ioremap_resource() can either be a pointer to the remapped memory or an ERR_PTR() encoded error code if the operation fails.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel resource-leak bug in the STM32 power regulator driver. Under driver probe failure conditions, mapped I/O memory may not be released. The sources do not provide CVSS scoring, active exploitation evidence, or broad impact claims.

Executive priority

Treat as routine kernel hygiene unless you operate STM32-based embedded products. There is no cited active exploitation, no CVSS score, and the impact described is a leak on driver probe failure. Patch through normal kernel maintenance windows.

Technical view

In drivers/regulator/stm32-pwr.c, stm32_pwr_regulator_probe() used of_iomap() and missed cleanup when allocation or regulator registration failed. The fix replaces it with devm_platform_ioremap_resource(), which binds cleanup to the device lifecycle and handles ERR_PTR-style errors.

Likely exposure

Exposure appears limited to Linux systems using affected kernel versions with the STM32 PWR regulator driver relevant to STM32 platforms. General Linux servers are unlikely to be exposed unless this driver and hardware path are present.

Exploitation context

The bundle says KEV is false and provides no evidence of exploitation. The described condition is a cleanup failure during probe error paths, not a remote attack path. Exploitability and practical impact are not established by the provided sources.

Researcher notes

The key evidence is the kernel commit rationale: Smatch found base from of_iomap() unreleased on failure paths. Research should focus on reachability of probe failure paths, kernel configuration, platform device exposure, and whether repeated failures could produce meaningful resource exhaustion.

Mitigation direction

  • Update to a kernel or vendor package containing the cited stable fixes.
  • For appliances, request vendor confirmation that their kernel includes the stm32-pwr fix.
  • Prioritize STM32-based embedded Linux fleets over unrelated server environments.
  • If no package is available, follow vendor kernel backport guidance.

Validation and detection

  • Inventory systems running affected Linux kernel versions listed in the CVE bundle.
  • Confirm whether the STM32 PWR regulator driver is built or loaded.
  • Compare kernel source or package changelog against the cited stable commits.
  • Regression test boot and regulator behavior on affected STM32 hardware after updating.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54097 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740, dc62f951a6a8490bcccc7b6de36cd85bd57be740unaffected
LinuxLinux5.2, 0, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.