CVE-2023-54115

pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()

When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket_data too, causing a memory leak observable with kmemleak:

unreferenced object 0xc28d1000 (size 64): comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................ 00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................ backtrace: [<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0 [<7e51f0c8>] kmalloc_trace+0x31/0xa4 [<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc] [<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core] [<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket] [<c48fac39>] pci_device_probe+0x99/0x194 [<84b7c690>] really_probe+0x181/0x45c [<8060fe6e>] __driver_probe_device+0x75/0x1f4 [<b9b76f43>] driver_probe_device+0x28/0xac [<648b766f>] __driver_attach+0xeb/0x1e4 [<6e9659eb>] bus_for_each_dev+0x61/0xb4 [<25a669f3>] driver_attach+0x1e/0x28 [<d8671d6b>] bus_add_driver+0x102/0x20c [<df0d323c>] driver_register+0x5b/0x120 [<942cd8a4>] __pci_register_driver+0x44/0x4c [<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]

Fix this by freeing socket_data too.

Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding the yenta_cardbus driver (yenta_socket).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bde0b6da7bd893c37afaee3555cc3ac3be582313Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2d45e2be0be35a3d66863563ed2591ee18a6897eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22100df1d57f04cf2370d5347b9ef547f481deeaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04bb8af40a7729c398ed4caea7e66cedd2881719Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 97fd1c8e9c5aa833aab7e836760bc13103afa892Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e8a80cf06b4bb0396212289d651b384c949f09d0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fd53a1f28faba2c4806c055e706a7721006291c1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c85fd9422fe0f5d667305efb27f56d09eab120b0Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.14.324 through 4.14.Not affected 4.19.293 through 4.19.Not affected 5.4.255 through 5.4.Not affected 5.10.192 through 5.10.Not affected 5.15.128 through 5.15.Not affected 6.1.47 through 6.1.Not affected 6.4.12 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bde0b6da7bd893c37afaee3555cc3ac3be582313Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2d45e2be0be35a3d66863563ed2591ee18a6897eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22100df1d57f04cf2370d5347b9ef547f481deeaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04bb8af40a7729c398ed4caea7e66cedd2881719Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 97fd1c8e9c5aa833aab7e836760bc13103afa892Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e8a80cf06b4bb0396212289d651b384c949f09d0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fd53a1f28faba2c4806c055e706a7721006291c1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c85fd9422fe0f5d667305efb27f56d09eab120b0Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.14.324 through 4.14.*Not affected
4.19.293 through 4.19.*Not affected
5.4.255 through 5.4.*Not affected
5.10.192 through 5.10.*Not affected
5.15.128 through 5.15.*Not affected
6.1.47 through 6.1.*Not affected
6.4.12 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.