CVE-2023-54316
Use-After-Initialization Bug in Linux Kernel refscale Causes Kernel Crash
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel occurs because a wait queue head is used before it is properly initialized. Specifically, the function init_waitqueue_head() is called after creating a kernel thread (kthread) that uses this wait queue head. If the kthread starts running before the wait queue head is initialized, it can cause the kernel to crash due to accessing invalid memory addresses. The issue arises from a race condition where the kthread may be delayed between its creation and the initialization call, leading to uninitialized use of wait_queue_head_t and resulting in a page fault and kernel crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash unexpectedly when running the refscale test or similar workloads that trigger this race condition. Such kernel crashes can lead to system instability, downtime, and potential data loss or corruption. It affects the reliability and availability of systems running vulnerable kernel versions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system kernel logs for crash messages similar to the following: [ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8 [ 8569.952900] #PF: supervisor read access in kernel mode [ 8569.952902] #PF: error_code(0x0000) - not-present page [ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI [ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190 You can check kernel logs using commands such as: - dmesg | grep -i 'BUG: unable to handle page fault' - journalctl -k | grep -i 'BUG: unable to handle page fault' These commands help identify if the kernel has crashed due to this issue.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to apply the patch that ensures init_waitqueue_head() is called before creating the kthread, preventing the uninitialized use of wait_queue_head_t. Until the patch is applied, avoid running the refscale test or any workload that triggers the ref_scale_reader kthread to prevent kernel crashes.