CVE-2023-54160: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54160 is a Linux kernel vulnerability in the firmware: arm_sdei subsystem, specifically a "sleep from invalid context" bug triggered when a sleeping function is called from an invalid (interrupt-disabled) context. The issue manifests on preempt-rt kernels (e.g., v6.2-rc3-rt1) running on Ampere Altra hardware during CPU hotplug operations, where sdei_cpuhp_up() acquires a spinlock while IRQs are disabled. It was published to NVD on December 24, 2025, and has an EPSS score of 0.024% (Feedly, CVE.org). No CVSS score has been assigned at this time.

The root cause is an improper locking context in the ARM Software Delegated Exception Interface (SDEI) CPU hotplug handler (sdei_cpuhp_up). On PREEMPT_RT kernels, standard spinlocks are replaced with sleeping locks (rt_mutex-based), meaning acquiring them while IRQs are disabled (as occurs in the cpuhp thread after cpuhp_thread_fun disables hardirqs) triggers a might_sleep() BUG. The call trace shows rt_spin_lock being invoked from sdei_cpuhp_up+0x3c/0x130 while holding sdei_list_lock with IRQs disabled, violating the PREEMPT_RT locking rules (CWE-667: Improper Locking). Fixes are available as stable kernel patches (Kernel Git, Kernel Git).

The primary impact is a kernel BUG (panic or system instability) on affected systems running PREEMPT_RT kernels, resulting in a denial of service. The bug is triggered during CPU hotplug operations (CPU bring-up), which can cause the system to crash or become unresponsive. There is no known confidentiality or integrity impact; the vulnerability is limited to availability of the affected system (Feedly).

Apply the upstream Linux kernel stable patches that fix the improper locking in sdei_cpuhp_up. Multiple stable-branch commits address this issue: 7d8f5cc, 18d5ea5, 48ac727, 66caf22, and 59842a9. As a workaround, systems not requiring PREEMPT_RT can use a standard (non-RT) kernel to avoid the issue. Administrators running PREEMPT_RT kernels on ARM SDEI-capable hardware should prioritize applying the relevant stable kernel update.