CVE-2023-54056: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54056 is a vulnerability in the Linux kernel's kheaders module where kernel_headers_data is incorrectly declared as a char type instead of a byte array. Under CONFIG_FORTIFY_SOURCE, this causes memcpy() to detect a buffer overflow condition and trigger a kernel panic when /sys/kernel/kheaders.tar.xz is read. The vulnerability affects Linux kernel versions from 5.2 up to the patched stable releases (5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4). It was published on December 24, 2025, with a CVSS base score of 0.0 (no severity assigned) and an EPSS score of 0.0003 (Feedly, EUVD).

The root cause is an improper type declaration in the kheaders kernel module: kernel_headers_data is defined as a char variable rather than a byte array (CWE-131: Incorrect Calculation of Buffer Size / improper buffer declaration). When CONFIG_FORTIFY_SOURCE is enabled, the kernel's hardened memcpy() implementation checks source and destination buffer sizes at compile or runtime; declaring the symbol as char causes the size to be computed as 1 byte, which immediately fails the bounds check when any data is copied. The bug manifests when a user reads /sys/kernel/kheaders.tar.xz, triggering ikheaders_read() → kernfs_fop_read_iter() → memcpy() → fortify_panic(), resulting in a kernel BUG at lib/string_helpers.c:1027. The fix changes the declaration to match the array-style used elsewhere in the kernel (Feedly).

Successful triggering of this vulnerability causes a kernel panic (BUG) on systems with CONFIG_FORTIFY_SOURCE enabled, resulting in a denial of service (system crash) for any user or process that reads /sys/kernel/kheaders.tar.xz. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability. The affected asset is any Linux system running a vulnerable kernel version with both CONFIG_IKHEADERS and CONFIG_FORTIFY_SOURCE enabled (Feedly, EUVD).

1. Precondition check: Confirm the target Linux system has CONFIG_IKHEADERS=m (or =y) and CONFIG_FORTIFY_SOURCE=y set in the kernel configuration, and that the kheaders module is loaded.
2. Trigger the bug: As any local user with read access to sysfs, execute: cat /sys/kernel/kheaders.tar.xz >> /dev/null
3. Observe kernel panic: The ikheaders_read() function calls memcpy() with the incorrectly-typed kernel_headers_data symbol; CONFIG_FORTIFY_SOURCE detects the apparent single-byte buffer and calls fortify_panic(), triggering a kernel BUG at lib/string_helpers.c:1027 and crashing the system (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing detected buffer overflow in memcpy, kernel BUG at lib/string_helpers.c:1027, and RIP: 0010:fortify_panic+0xf/0x20.
• Logs: Call trace entries referencing ikheaders_read+0x45/0x50 [kheaders] and kernfs_fop_read_iter+0x1a4/0x2f0.
• System: Unexpected system reboot or kernel panic coinciding with access to /sys/kernel/kheaders.tar.xz.

Apply the upstream kernel patches available for the following stable versions: 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. The fix changes the kernel_headers_data declaration from char to a byte array in the kheaders module. As a workaround, administrators can unload the kheaders module (rmmod kheaders) or disable CONFIG_IKHEADERS in the kernel configuration if kernel header exposure via sysfs is not required (Feedly, EUVD).