CVE-2023-54113: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54113 is a Linux kernel vulnerability in the RCU (Read-Copy-Update) subsystem related to unsafe dumping of vmalloc memory information. When call_rcu() is invoked for a double-invocation scenario, it attempts to dump rcu_head object memory info; if the object is not allocated from the slab allocator, vmalloc_dump_obj() is called, which requires holding the vmap_area_lock spinlock. Since call_rcu() can be invoked in interrupt context, this creates a potential spinlock deadlock. The vulnerability was published on December 24, 2025, and affects the Linux kernel (Feedly). No CVSS score has been officially assigned at this time.

The root cause is an unsafe locking pattern (CWE-667: Improper Locking) in the Linux kernel's RCU subsystem. When a double call_rcu() invocation is detected, the kernel attempts to dump vmalloc memory info by calling vmalloc_dump_obj(), which internally acquires the vmap_area_lock spinlock. Because call_rcu() is legally callable from interrupt context, acquiring a spinlock that may already be held in a non-interrupt context creates a classic deadlock scenario. On Preempt-RT kernels, this is further exacerbated because spinlocks are converted to sleeping locks, triggering a lockdep warning: BUG: sleeping function called from invalid context with in_atomic(): 1, irqs_disabled(): 1 (Feedly). The fix involves ensuring vmalloc memory info is dumped safely without holding the problematic spinlock in interrupt context.

The primary impact is a kernel deadlock or system hang, affecting availability of the Linux system. On standard kernels, the deadlock can cause the system to become unresponsive; on Preempt-RT kernels, the lockdep warning indicates a violation of locking rules that can lead to kernel crashes or undefined behavior. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been applied to the Linux kernel stable trees via multiple commits: 0a22f9c17b1a, 3f7a4e88e40e, 8fb1601ec0a2, c83ad36a18c0, and dddca4c46ec9 (Linux Kernel). Administrators should update to a patched kernel version that includes these commits. Preempt-RT kernel users are particularly advised to prioritize patching, as the issue manifests more visibly on those kernels. No configuration-based workaround is known; kernel update is the recommended remediation.