CVE-2023-54188 dmaengine: apple-admac: Fix 'current_tx' not getting freed
A memory leak in the Apple ADMAC DMA engine driver allows attackers to cause a denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54188?
CVE-2023-54188 is a memory corruption vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: apple-admac: Fix 'current_tx' not getting freed
In terminate_all we should queue up all submitted descriptors to be freed. We do that for the content of the 'issued' and 'submitted' lists, but the 'current_tx' descriptor falls through the cracks as it's removed from the 'issued' list once it gets assigned to be the current descriptor. Explicitly queue up freeing of the 'current_tx' descriptor to address a memory leak that is otherwise present.
Which versions are affected by CVE-2023-54188?
How do I fix CVE-2023-54188?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-54188 being exploited?
There is no known exploitation of CVE-2023-54188 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54188, DEBIAN-CVE-2023-54188, GHSA-vvr9-4v54-jx9g, UBUNTU-CVE-2023-54188.