CVE-2023-54045
Soft Lockup in Linux Kernel Audit Causes System Hang
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a possible soft lockup in the Linux kernel's audit subsystem, specifically in the __audit_inode_child() function. When using tracefs or debugfs, creating many PATH records can cause the system to become unresponsive (soft lockup), potentially leading to a kernel panic. The issue occurs under certain configurations and conditions, such as when CONFIG_KASAN is enabled and CONFIG_PREEMPTION is disabled, and when audit rules are set to always log open system calls. The fix involved adding a conditional reschedule (cond_resched()) call to the __audit_inode_child() function to prevent the CPU from being stuck.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to experience a soft lockup, where the CPU becomes stuck for several seconds, leading to system unresponsiveness or a kernel panic. This can disrupt normal system operations, potentially causing downtime or loss of availability for services running on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for soft lockup messages in the kernel logs, such as 'watchdog: BUG: soft lockup - CPU# stuck for several seconds' or kernel panic messages related to softlockup. You can check the kernel logs using commands like 'dmesg | grep -i softlockup' or 'journalctl -k | grep -i softlockup'. Additionally, monitoring the creation of many PATH records in tracefs or debugfs and auditctl rules related to open syscalls may help detect conditions leading to this issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding configurations that trigger the vulnerability, such as using CONFIG_KASAN=y with CONFIG_PREEMPTION=n, and avoiding creating many PATH records in tracefs or debugfs. You can also adjust the kernel watchdog threshold (e.g., 'sysctl -w kernel.watchdog_thresh=5') cautiously. Ultimately, applying the kernel patch that adds cond_resched() to __audit_inode_child() to prevent the soft lockup is necessary.