LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54228: regulator: raa215300: Fix resource leak in case of error

In the Linux kernel, the following vulnerability has been resolved: regulator: raa215300: Fix resource leak in case of error The clk_register_clkdev() allocates memory by calling vclkdev_alloc() and this memory is not freed in the error path. Similarly, resources allocated by clk_register_fixed_rate() are not freed in the error path. Fix these issues by using devm_clk_hw_register_fixed_rate() and devm_clk_hw_register_clkdev(). After this, the static variable clk is not needed. Replace it with  local variable hw in probe() and drop calling clk_unregister_fixed_rate() from raa215300_rtc_unregister_device().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel resource leak in the raa215300 regulator driver. It affects a narrow driver path, not a general remote-service exposure. The sources do not provide CVSS, active exploitation evidence, or a named workaround, so business urgency depends on whether affected kernels and this driver are present in your fleet.

Executive priority

Treat as targeted kernel maintenance unless you operate affected hardware or embedded Linux images. Do not defer indefinitely, but this should rank below actively exploited or remotely reachable vulnerabilities unless internal validation shows the driver is present and important.

Technical view

The driver failed to release memory/resources allocated by clk_register_clkdev() and clk_register_fixed_rate() when probe-time errors occurred. The kernel fix moves those registrations to device-managed APIs and removes the prior static clock cleanup pattern. The source bundle lists affected Linux 6.5 through before 6.5.4 and 6.6-related state, but version metadata is limited.

Likely exposure

Likely limited to Linux systems with affected kernels that include and use the raa215300 regulator driver. Exposure is most plausible in embedded or hardware-specific deployments. The provided sources do not identify distributions, appliances, cloud images, or user-space applications affected.

Exploitation context

No KEV listing is provided, and the source bundle does not cite active exploitation. The described issue is an error-path resource leak, not a documented remote code execution path. Practical exploitability and business impact are not established in the provided evidence.

Researcher notes

Evidence is limited to the CVE record and kernel stable commits. No CVSS, CWE, exploit report, or downstream advisory is included. Focus analysis on driver reachability, affected kernel lineage, and whether failed probe paths can cause meaningful availability impact in your environment.

Mitigation direction

  • Update to a kernel containing the cited stable fixes.
  • Check your Linux distribution or device vendor advisory for packaged fixed versions.
  • Prioritize systems using the raa215300 regulator driver or related hardware.
  • If no vendor fix is available, track vendor guidance rather than applying ad hoc changes.

Validation and detection

  • Inventory kernel versions across Linux and embedded fleets.
  • Determine whether the raa215300 driver is built, loaded, or required.
  • Confirm the cited fix commits appear in your kernel source or package changelog.
  • Review vendor advisories for corrected package versions and reboot requirements.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54228 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7bce16630837c705f72e8fd53a11ae8c236236f4, 7bce16630837c705f72e8fd53a11ae8c236236f4unaffected
LinuxLinux6.5, 0, 6.5.4, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.