CVE-2023-53487: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's powerpc/rtasflash component, tracked as CVE-2023-53487. The issue occurs when using the /proc/powerpc/rtas/firmwareupdate interface to prepare a system firmware update with hardened usercopy enabled (CONFIGHARDENEDUSERCOPY=y). The vulnerability was disclosed on October 1, 2025, affecting the Linux kernel's firmware update functionality on PowerPC systems (NVD).

The vulnerability manifests when blocks of firmware image are copied directly from user memory to objects allocated from flashblockcache. The issue arises because flashblockcache was not created using kmemcachecreate_usercopy() to mark it safe for user access. This results in a kernel BUG at mm/usercopy.c:102 when attempting the operation, triggering an exception in kernel mode with signal 5 (NVD).

When exploited, this vulnerability causes a kernel panic through a BUG() assertion, leading to system instability and potential denial of service on affected PowerPC systems running Linux with hardened usercopy enabled (NVD).

The fix involves modifying the flashblockcache to be created using kmemcachecreate_usercopy(), properly marking it as safe for user access during firmware update operations (NVD).