LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54255: sh: dma: Fix DMA channel offset calculation

In the Linux kernel, the following vulnerability has been resolved: sh: dma: Fix DMA channel offset calculation Various SoCs of the SH3, SH4 and SH4A family, which use this driver, feature a differing number of DMA channels, which can be distributed between up to two DMAC modules. The existing implementation fails to correctly accommodate for all those variations, resulting in wrong channel offset calculations and leading to kernel panics. Rewrite dma_base_addr() in order to properly calculate channel offsets in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that the correct DMAC module base is selected for the DMAOR register.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54255 is a Linux kernel bug in the SuperH DMA driver. On certain SH3, SH4, and SH4A systems, the kernel can calculate the wrong DMA channel address and panic. The main business risk is availability loss on affected embedded or legacy systems, not broad internet-facing compromise based on the supplied evidence.

Executive priority

Handle through normal vulnerability management, with higher priority for production embedded systems where unexpected reboots affect safety, operations, or service availability. Broad enterprise emergency response is not supported by the supplied evidence.

Technical view

The flaw is in DMA channel offset handling for SH-family SoCs with differing DMA channel counts across one or two DMAC modules. Incorrect module or channel base selection can access the wrong register area and cause kernel panics. The referenced stable commits rewrite dma_base_addr() and correct DMAOR register access.

Likely exposure

Exposure appears limited to Linux systems running the SuperH architecture DMA driver on SH3, SH4, or SH4A SoCs. General x86, ARM, or cloud Linux deployments are not indicated as affected by the provided sources.

Exploitation context

The source bundle does not show CISA KEV listing, active exploitation, exploit availability, or attacker preconditions. The documented outcome is kernel panic from incorrect DMA register offset calculations, so treat this primarily as a platform-specific denial-of-service reliability issue unless vendor guidance says otherwise.

Researcher notes

Evidence identifies a kernel correctness bug fixed by stable commits, but no CVSS, CWE, exploit status, or detailed attack path is provided. Analysis should stay tied to SH-family DMA driver reachability and vendor kernel backport status.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Check distribution or device vendor advisories for packaged kernel fixes.
  • Prioritize embedded, industrial, or legacy devices using SH3, SH4, or SH4A SoCs.
  • If updates are unavailable, ask the vendor for supported mitigation guidance.

Validation and detection

  • Inventory systems using the Linux SuperH architecture and SH DMA driver.
  • Compare deployed kernel source or package changelogs against the referenced stable commits.
  • Review crash logs for DMA, DMAC, or DMAOR-related kernel panics.
  • After patching, validate DMA-dependent workloads on affected hardware.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54255 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582, 7f47c7189b3e8f19a589f77a3ad169d7b691b582unaffected
LinuxLinux3.5, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.