CVE-2023-54019: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54019 is a Use-After-Free (UAF) vulnerability in the Linux kernel's PSI (Pressure Stall Information) subsystem, specifically in the sched/psi component. The flaw occurs when a cgroup is removed while a polling process is still active on the associated PSI trigger file, causing the trigger's waitqueue head to be freed while still being accessed. It affects the Linux kernel and was published on December 24, 2025. The estimated CVSS severity is Medium, with an EPSS score of 0.000170 (Feedly, CVE.org).

The root cause is a Use-After-Free condition (CWE-416) in the PSI trigger lifecycle management within the Linux kernel's cgroup subsystem. When a cgroup is removed via do_rmdir, cgroup_file_release is called and destroys the PSI trigger (including its event_wait waitqueue head) even though the file itself may still be open and actively polled by a process. A prior patch addressed this for the epoll() case using wake_up_pollfree(), but the synchronous poll() path remained vulnerable — after psi_trigger_destroy frees the trigger, a concurrent poll_freewait call can access the already-freed waitqueue head. The fix involves using kernfs polling functions to decouple the trigger's waitqueue lifecycle from the cgroup file release path (Feedly, CVE.org).

Successful exploitation of this UAF vulnerability can lead to kernel memory corruption, potentially resulting in a system crash (denial of service) or, in more severe scenarios, privilege escalation if an attacker can control the freed memory region. The vulnerability is local in nature, requiring the ability to create/remove cgroups and open PSI trigger files, which limits its scope primarily to local users or processes with sufficient cgroup permissions. Data integrity and system availability are the primary concerns, as kernel-level memory corruption can have unpredictable consequences (Feedly).

The fix is included in upstream Linux kernel patches that switch PSI trigger polling to use kernfs polling functions, preventing the UAF by ensuring the trigger's waitqueue is not destroyed while still in use. SUSE has released kernel security updates addressing this CVE (e.g., SUSE-2026-0281-1, SUSE-2026-0350-1, SUSE-2026-20876-1). Users should apply the latest kernel updates from their Linux distribution vendor as soon as they are available. Limiting cgroup management permissions to trusted users can reduce the attack surface in the interim (Feedly, Linux Security SUSE Advisory).