LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54190: leds: led-core: Fix refcount leak in of_led_get()

In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not need anymore.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel resource-management flaw in the LED subsystem. A device reference acquired during LED lookup was not released, creating a reference-count leak. The provided sources do not give a CVSS score, attack path, or business-impact evidence, so urgency should be driven by kernel exposure and vendor patch status.

Executive priority

Treat as routine kernel maintenance unless your environment has exposed embedded Linux fleets or strict availability requirements. There is no sourced evidence of exploitation or severe impact, but unpatched kernel defects should still be closed through standard patch cycles.

Technical view

The issue is in leds:led-core, specifically of_led_get(). class_find_device_by_of_node() ultimately takes a device reference through class_find_device(), and the fix releases it with put_device() when no longer needed. The bundle identifies Linux kernel affected version boundary data and stable kernel fix commits.

Likely exposure

Systems running affected Linux kernel versions with the LED core code present may be exposed. The source bundle does not identify specific distributions, appliances, configurations, or whether LED hardware or device-tree paths are required for practical impact.

Exploitation context

No active exploitation is cited, and the CVE is not marked KEV in the supplied bundle. The sources describe a kernel reference-count leak fix, but do not document exploitability, privilege requirements, remote attack surface, or proof-of-concept activity.

Researcher notes

The public description is narrow: a missing put_device() after a reference-acquiring lookup. Impact is not characterized beyond the leak. Avoid overstating severity without kernel-maintainer, distribution, or CVSS evidence. Validate exact affected intervals from the CVE JSON or vendor advisories before enforcement.

Mitigation direction

  • Check your Linux kernel version against vendor advisories and stable fix commits.
  • Prioritize normal kernel updates for affected hosts and embedded Linux images.
  • Use distribution-provided kernels rather than manually cherry-picking unless required.
  • Track vendor guidance because no separate workaround is provided in the bundle.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded builds.
  • Compare deployed kernels with the CVE version data and referenced stable commits.
  • Confirm whether vendor kernel packages include the of_led_get() refcount fix.
  • Review fleet vulnerability scanner results for CVE-2023-54190 after patching.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54190 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux699a8c7c4bd376aee4808e6272188319e900c8af, 699a8c7c4bd376aee4808e6272188319e900c8af, 699a8c7c4bd376aee4808e6272188319e900c8af, 699a8c7c4bd376aee4808e6272188319e900c8af, 699a8c7c4bd376aee4808e6272188319e900c8afunaffected
LinuxLinux5.6, 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.