CVE-2023-54111 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups

Not scored Published 24 Dec 2025 Updated 11 May 2026

A refcount leak in the Linux kernel pinctrl driver can lead to memory exhaustion and denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: Not needed
Fix: Available

What is CVE-2023-54111?

CVE-2023-54111 is a memory corruption vulnerability in Linux, published on 24 Dec 2025.

Official description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups

of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.

Which versions are affected by CVE-2023-54111?

How do I fix CVE-2023-54111?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-54111 being exploited?

There is no known exploitation of CVE-2023-54111 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2023-54111, DEBIAN-CVE-2023-54111, GHSA-x7cf-f53m-6v2m, UBUNTU-CVE-2023-54111.