CVE-2023-52992: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52992 is a vulnerability in the Linux kernel that was discovered and disclosed on March 27, 2025. The vulnerability affects the BPF (Berkeley Packet Filter) subsystem, specifically in the send_signal_common() function's handling of tasks with PID 1 (NVD CVE).

The vulnerability occurs when a task with PID 1 (typically the init/systemd process) attaches a BPF program that attempts to send a killing signal to itself. This triggers a kernel panic with the message 'Attempted to kill init!' and a specific call trace through various kernel functions including dump_stack, panic, do_exit, and signal handling routines. The issue was resolved by implementing a skip mechanism for tasks with PID 1 in the bpf_send_signal_common() function (NVD CVE).

When exploited, this vulnerability causes a kernel panic, effectively crashing the system. This results in a denial of service condition as the system becomes unresponsive and requires a restart. The impact is particularly significant as it affects PID 1, which is a critical system process (NVD CVE).

The vulnerability can be triggered when a BPF program attached to PID 1 attempts to send a killing signal to itself. The specific conditions for exploitation require the ability to attach BPF programs to the init process, which typically requires elevated privileges (NVD CVE).

The vulnerability has been patched by implementing a check to skip tasks with PID 1 in the bpf_send_signal_common() function. Users should update their Linux kernel to a version that includes this fix (NVD CVE).