CVE-2023-54045: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54045 is a soft lockup vulnerability in the Linux kernel's audit subsystem, specifically in the __audit_inode_child() function. When tracefs or debugfs operations generate hundreds to thousands of PATH audit records (e.g., by creating a tracefs instance via mkdir /sys/kernel/debug/tracing/instances/test), the kernel can become stuck in a CPU-bound loop, triggering a soft lockup and potentially a kernel panic. The vulnerability was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. It carries an EPSS score of 0.033% (low), indicating limited exploitation probability (Feedly, CVE.org).

The root cause is an unbounded loop in __audit_inode_child() (CWE-400: Uncontrolled Resource Consumption) that processes audit PATH records without yielding the CPU. When tracefs or debugfs creates a large number of filesystem entries — each triggering an audit PATH record — the function can monopolize a CPU core for several seconds, exceeding the kernel watchdog threshold (default or reduced via kernel.watchdog_thresh). The issue is exacerbated on non-preemptible kernels (CONFIG_PREEMPTION=n) and with memory debugging enabled (CONFIG_KASAN=y). The fix involves adding a cond_resched() or equivalent yield point within the loop to allow other tasks to run (Feedly, kernel.org patch).

Successful triggering of this vulnerability causes a CPU soft lockup on the affected kernel, which can escalate to a kernel panic (softlockup: hung tasks) and system crash, resulting in a complete denial of service. Availability is the primary impact — confidentiality and integrity are not directly affected. Systems running audit rules that monitor filesystem syscalls (e.g., open) combined with tracefs/debugfs activity are most at risk, particularly in environments with non-preemptible kernels (Feedly).

1. Precondition: Obtain local access to a Linux system with audit enabled, a non-preemptible kernel (CONFIG_PREEMPTION=n), and optionally CONFIG_KASAN=y for increased impact.
2. Configure audit rule: Run auditctl -a exit,always -S open -k key to enable auditing of all open syscalls, which causes PATH records to be generated for filesystem operations.
3. Reduce watchdog threshold (optional, to accelerate lockup): Run sysctl -w kernel.watchdog_thresh=5 to lower the soft lockup detection threshold to 5 seconds.
4. Trigger mass PATH record generation: Execute mkdir /sys/kernel/debug/tracing/instances/test to create a tracefs instance, which causes the kernel to generate hundreds to thousands of audit PATH records in rapid succession.
5. Observe soft lockup: The __audit_inode_child() function loops over all PATH records without yielding, causing CPU#N to appear stuck, triggering the watchdog and potentially a kernel panic (Feedly).

• Logs: Kernel messages containing BUG: soft lockup - CPU#N stuck for Xs! with mkdir or similar process names; Kernel panic - not syncing: softlockup: hung tasks in dmesg or /var/log/kern.log.
• Logs: Kernel call trace referencing __audit_inode_child, tracefs_create_file, event_create_dir, trace_array_create, or instance_mkdir in the panic/lockup backtrace.
• Process: Unusual or repeated creation of directories under /sys/kernel/debug/tracing/instances/ by non-administrative users.
• System: Sudden system reboot or crash following tracefs directory creation on systems with active audit rules (Feedly).

Apply the upstream Linux kernel patches that introduce a CPU yield point (e.g., cond_resched()) inside __audit_inode_child(). Patches have been committed to multiple stable kernel branches (commits: 8a40b49, 8e76b94, 9ca08ad, 98ef243, 0152e77). As a workaround, avoid configuring broad audit rules (e.g., auditing all open syscalls) on systems where tracefs/debugfs is actively used, or restrict access to /sys/kernel/debug/tracing/instances/. Enabling kernel preemption (CONFIG_PREEMPTION=y) can also reduce the likelihood of triggering the lockup. SUSE has issued kernel updates addressing this CVE (Linux Security SUSE Advisory).

Qualys has added detection signatures for CVE-2023-54045 across multiple plugin IDs (760604, 760644, 761056), and Tenable has also published Nessus plugins (279891, 301595) for detection. SUSE has released kernel updates addressing this vulnerability. No notable public researcher commentary or significant social media discussion has been identified for this CVE.