CVE-2023-54086
Stack Overflow Vulnerability in Linux Kernel BPF Trampoline Functions
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the BPF (Berkeley Packet Filter) subsystem where the recursion check in __bpf_prog_enter* and __bpf_prog_exit* functions leaves preempt_count_sub and preempt_count_add unprotected. When a trampoline is attached to these functions, it causes a kernel panic due to stack guard page violations. The root cause is that in __bpf_prog_exit_recur, preempt_count_sub and preempt_count_add are called after the program's active count is decreased, leading to unsafe recursion. The fix was to add these two functions to the BTF (BPF Type Format) IDs deny list to prevent attaching trampolines to them.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to panic and crash when certain BPF trampolines are attached to the preempt_count_sub and preempt_count_add functions. This can lead to system instability, unexpected reboots, and potential denial of service conditions on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for kernel panic messages related to bpf trampoline and preempt_count_sub/add functions. Look for messages similar to 'BUG: TASK stack guard page was hit' or 'BUG: IRQ stack guard page was hit' with call traces involving preempt_count_sub, __bpf_prog_enter_recur, and bpf_trampoline. You can use commands like 'dmesg | grep -i "BUG:.*stack guard page"' or 'journalctl -k | grep -i "bpf_trampoline"' to find such kernel panic logs.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version where this vulnerability is fixed by adding preempt_count_sub and preempt_count_add into the BTF id deny list, preventing the panic caused by attaching trampolines to these functions. Until an update is applied, avoid attaching BPF trampolines to preempt_count_sub and preempt_count_add functions.