CVE-2023-54146: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54146 is a double-free vulnerability in the Linux kernel's x86 kexec subsystem, specifically within the crash_load_segments() function's error handling path. The flaw was introduced after commit b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"), which added a vfree() call in the error path that became redundant — and dangerous — because kimage_file_post_load_cleanup() already handles freeing image->elf_headers. Affected kernel versions span from 5.19 through stable branches prior to the respective fixes (patched in 5.15.87, 6.0.19, 6.1.5, and 6.2). The CVE was published on December 24, 2025, and carries an EPSS score of 0.018% (very low), with no CVSS base score assigned at time of publication (Feedly, EUVD).

The root cause is a double-free memory corruption bug (CWE-415) in the x86 kexec crash kernel loading path. When crash_load_segments() encounters an error after allocating the ELF header buffer (image->elf_headers), a superfluous vfree() call frees the buffer; subsequently, kimage_file_post_load_cleanup() attempts to free the same buffer again during cleanup, resulting in a double-free condition. The fix removes the redundant vfree() call from the error path of crash_load_segments(), relying solely on the existing cleanup function to manage the buffer's lifetime. Exploitation would require local kernel-level access to trigger the kexec crash kernel loading path under error conditions (Feedly, Kernel Patch 1).

A double-free in kernel memory can lead to heap corruption, potentially enabling a local attacker with sufficient privileges to escalate privileges, cause a kernel panic (denial of service), or achieve arbitrary code execution in kernel context. The vulnerability is confined to the x86 architecture's kexec crash kernel loading subsystem, limiting its scope to systems where kexec is enabled and accessible. Given the kernel-level nature of the bug, successful exploitation could result in complete system compromise or persistent denial of service (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 5.15.87, 6.0.19, 6.1.5, and 6.2. The fix removes the superfluous vfree() call from the error path of crash_load_segments() in arch/x86/kernel/crash.c. Administrators should update to a patched kernel version as soon as possible; as a temporary workaround, restricting access to kexec functionality (e.g., via kernel.kexec_load_disabled=1 sysctl) can reduce exposure on systems where kexec is not required (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).