CVE-2023-54183 media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
A resource leak in the Linux kernel's V4L2 core allows attackers to cause a denial of service by triggering specific firmware node parsing failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54183?
CVE-2023-54183 is a denial of service vulnerability in Linux, published on 30 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, so fwnode_handle_put() is a no-op.
Release the reference taken from a previous fwnode_graph_get_port_parent() call instead.
Also handle fwnode_graph_get_port_parent() failures.
In order to fix these issues, add an error handling path to the function and the needed gotos.
Which versions are affected by CVE-2023-54183?
How do I fix CVE-2023-54183?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-54183 being exploited?
There is no known exploitation of CVE-2023-54183 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54183, DEBIAN-CVE-2023-54183, GHSA-3jcf-h7p4-qqm8, UBUNTU-CVE-2023-54183.