CVE-2023-54235
BaseFortify
Publication date: 2025-12-30
Last updated on: 2025-12-31
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a race condition in the Linux kernel related to the function destroy_work_on_stack(). The issue occurs because destroy_work_on_stack() is called after signaling the completion of a work item, creating a race between destroying the work struct and the work struct going out of scope. This can lead to debug object splats and potential instability. The fix involves signaling the work completion only after the work struct has been safely destroyed.
How can this vulnerability impact me? :
This vulnerability can cause race conditions that may lead to kernel instability or crashes due to improper handling of work structs in the PCI DOE subsystem. It may affect system reliability and could potentially be exploited to cause denial of service or other unintended behavior in systems using the affected Linux kernel code.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing debug object splat messages in the kernel logs indicating a race condition with destroy_work_on_stack(). Look for kernel warnings similar to: 'ODEBUG: free active (active state 0) object' and 'WARNING: CPU: ... at lib/debugobjects.c:514 debug_print_object'. You can check kernel logs using commands like 'dmesg | grep debug_print_object' or 'journalctl -k | grep debug_print_object' to identify these messages.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the work struct is destroyed before signaling completion. Specifically, modify the code to signal work completion only after destroy_work_on_stack() has been called, as signaling completion before destroying the work struct creates a race condition. Applying the vendor's patch or updating to a kernel version where this fix is included is recommended.