CVE-2023-54303
Preemption Bug in Linux BPF Perf Event Causes Kernel Crashes
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's bpf_perf_event_output function. The function's nesting protection relies on preemption being disabled, which is true for kprobes and tracepoints. However, when called from uprobes context via bpf_prog_run_array_sleepable, preemption remains enabled. This allows a task to be preempted inside the nesting protection, potentially causing two tasks to use the same perf_sample_data buffer simultaneously. This can lead to kernel crashes and errors such as page faults and execution of NX-protected pages.
How can this vulnerability impact me? :
This vulnerability can cause kernel crashes and instability due to concurrent access to the same perf_sample_data buffer by multiple tasks. This may result in system crashes, page faults, and potential denial of service, affecting system reliability and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be done by monitoring kernel logs for crash messages related to this vulnerability. Look for kernel messages such as 'kernel tried to execute NX-protected page - exploit attempt?' or 'BUG: unable to handle page fault for address' in the system logs (e.g., using 'dmesg' or 'journalctl -k'). Specific commands include: 'dmesg | grep -i "kernel tried to execute NX-protected page"' and 'dmesg | grep -i "BUG: unable to handle page fault"'. These messages indicate crashes caused by the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version where this vulnerability is fixed by disabling preemption in bpf_perf_event_output. Until then, avoid running untrusted BPF programs that use bpf_perf_event_output, especially those involving uprobes. Monitoring and restricting usage of such BPF programs can reduce risk.