CVE-2023-54033: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54033 is a memory leak vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically affecting the LRU (Least Recently Used) and LRU_PERCPU hash map implementations. When a map update allocates a new element but subsequently fails to lock the target hash table bucket (returning -EBUSY), the allocated element is not released back to any free list, causing it to become permanently untracked. Over time, this leads to persistent -ENOMEM errors on LRU map updates. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 up to the respective fix commits across stable branches. No CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is a missing error-path cleanup in the BPF LRU and LRU_PERCPU hash map update logic, classifiable as CWE-401 (Missing Release of Memory after Effective Lifetime). During a map update, a new element is pre-allocated before the target bucket lock is acquired; if trylock fails and -EBUSY is returned to the caller, the allocated element is neither inserted into the hash table nor returned to the local free list, making it permanently inaccessible. The fix involves returning the orphaned element to the local free list in the error path when bucket locking fails. Patches were applied across multiple stable kernel branches, with fix commits at 1a9e80f757bb (mainline/6.4), 79ea1a12fb9a (6.3.5), 965e9cccbe6b (6.1.31), and b34ffb0c6d23 (5.15.115) (NVD, Feedly).

Successful triggering of this vulnerability causes a gradual exhaustion of the BPF LRU map's element pool, ultimately resulting in a permanent -ENOMEM condition that prevents any further updates to affected LRU or LRU_PERCPU hash maps. This is a local availability impact — processes or kernel subsystems relying on these BPF maps (e.g., networking, tracing, security enforcement programs) will experience denial-of-service behavior. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (NVD).

Apply the relevant stable kernel patch for your branch: Linux 5.15.115 (commit b34ffb0c6d23), 6.1.31 (commit 965e9cccbe6b), 6.3.5 (commit 79ea1a12fb9a), or 6.4+ (commit 1a9e80f757bb). No configuration-based workaround is available; upgrading to a patched kernel version is the only remediation. Systems not using BPF LRU or LRU_PERCPU hash maps are not functionally impacted but should still be patched as part of routine kernel maintenance (NVD, Feedly).