CVE-2023-54086: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54086 is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) subsystem where preempt_count_sub and preempt_count_add functions are left unprotected by the recursion check in __bpf_prog_enter* and __bpf_prog_exit*. When a BPF trampoline is attached to these functions, it triggers infinite recursion leading to a kernel panic (stack guard page hit). The vulnerability affects the Linux kernel and was published on December 24, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper protection boundary in the BPF trampoline recursion guard logic (CWE-674: Uncontrolled Recursion). In __bpf_prog_exit_recur, preempt_count_sub and preempt_count_add are called after prog->active is decremented, meaning the recursion guard is no longer active when these functions execute. If a BPF trampoline is attached to preempt_count_sub or preempt_count_add, the trampoline re-enters the BPF prog enter/exit path, which again calls preempt_count_sub/add, creating unbounded recursion that exhausts both the task stack and IRQ stack. The fix adds these two functions to the BTF ID deny list, preventing BPF trampolines from being attached to them (Red Hat Bugzilla).

Successful exploitation causes a kernel panic, resulting in a complete denial of service of the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker with local access and sufficient privileges to load BPF programs can crash the kernel by attaching a trampoline to the affected functions, potentially disrupting all services running on the host (Red Hat Advisory, Red Hat Bugzilla).

1. Prerequisite: Obtain a local account on a vulnerable Linux system with privileges sufficient to load and attach BPF programs (e.g., CAP_BPF or CAP_SYS_ADMIN).
2. Write BPF program: Craft a BPF program intended to be attached as a trampoline (fentry/fexit) to preempt_count_sub or preempt_count_add.
3. Attach trampoline: Use bpf() syscall with BPF_PROG_ATTACH or bpftrace/libbpf tooling to attach the BPF trampoline to preempt_count_sub or preempt_count_add.
4. Trigger recursion: Once attached, any kernel code path invoking preempt_count_sub/add will trigger the BPF trampoline, which re-enters __bpf_prog_enter_recur/__bpf_prog_exit_recur, causing infinite recursion.
5. Kernel panic: The recursive calls exhaust the task and IRQ stacks, hitting stack guard pages and causing a kernel panic (denial of service) (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg//var/log/kern.log) showing BUG: TASK stack guard page was hit or BUG: IRQ stack guard page was hit entries, accompanied by a call trace involving preempt_count_sub, __bpf_prog_enter_recur, __bpf_prog_exit_recur, and bpf_trampoline_*.
• Process: Unexpected kernel panic or system reboot preceded by a process loading BPF programs (e.g., bpftrace, trace, or custom BPF loader binaries).
• Logs: Audit logs showing bpf() syscall invocations with BPF_PROG_LOAD and subsequent BPF_PROG_ATTACH targeting preempt_count_sub or preempt_count_add BTF IDs (Red Hat Bugzilla).

The fix adds preempt_count_sub and preempt_count_add to the BPF BTF ID deny list, preventing trampolines from being attached to these functions. Patches have been committed to the Linux kernel stable tree (commits 60039bf72f81, 095018267c87, b9168d41b83d, c11bd046485d). Users should update to a patched kernel version as provided by their Linux distribution. As a workaround, restricting unprivileged access to BPF program loading (e.g., setting kernel.unprivileged_bpf_disabled=1) reduces exposure (Red Hat Advisory, Red Hat Bugzilla).