CVE-2023-54152: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54152 is a deadlock vulnerability in the Linux kernel's CAN J1939 protocol implementation that can allow a low-privileged local attacker to trigger a denial of service. The flaw was publicly disclosed on December 24, 2025, and affects Linux kernel versions from commit 5b9272e93f2e up to the patched releases: 5.15.106, 6.1.23, 6.2.10, and 6.3. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a locking order inconsistency (CWE-667: Improper Locking) in the Linux kernel's J1939 CAN subsystem. A deadlock can occur when data TP/ETP transfer is in progress and a process subscribes to the error queue while simultaneously receiving a network-down event. Three lock chains interact: j1939_session_list_lock → active_session_list_lock, sk_session_queue_lock → j1939_socks_lock, and j1939_socks_lock → active_session_list_lock — creating a circular dependency across CPU0 and CPU1. The fix moves the j1939_sk_errqueue() call outside the active_session_list_lock context to break the circular dependency (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes the affected Linux system to enter a deadlock state, rendering it unresponsive and resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability requires local access with low privileges and does not enable lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

Update to a patched Linux kernel version: 5.15.106, 6.1.23, 6.2.10, or 6.3 (or later). The fix is available via upstream stable kernel commits 8a581b71cf68, ace6aa2ab5ba, f09ce9d765de, and d1366b283d94. As a compensating control, restricting local user access to CAN/J1939 socket interfaces can reduce the attack surface until patching is feasible (Red Hat Bugzilla, Kernel Patch).