CVE-2023-54165: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54165 is a vulnerability in the Linux kernel's zsmalloc memory allocator subsystem, specifically involving incorrect LRU (Least Recently Used) list management in the zs_map_object() function. The flaw causes list corruption under memory pressure, leading to kernel crashes. It was published on December 30, 2025, and affects the Linux kernel. The CVSS score and severity rating are not yet publicly assigned (Feedly).

The root cause is a race condition or improper ordering of LRU list updates within the zsmalloc subsystem of the Linux kernel. Specifically, the LRU update was incorrectly placed in zs_map_object() rather than zs_malloc(), which under memory pressure could result in a list_del corruption — where a list entry's next pointer is set to LIST_POISON1 (0xdead000000000100), indicating a double-free or use-after-free of a list node (CWE-416 or CWE-415). The fix moves the LRU update from zs_map_object() to zs_malloc() to ensure correct ordering. The crash manifests as a kernel WARNING in __list_del_entry_valid at lib/list_debug.c:47 (Feedly). Patches are available via the stable kernel tree at git.kernel.org.

Successful triggering of this vulnerability causes a kernel crash (denial of service) on affected Linux systems under memory pressure conditions. The corruption of the zsmalloc LRU list can destabilize the kernel's memory management subsystem, potentially leading to system instability or an unrecoverable kernel panic. There is no evidence of confidentiality or integrity impact beyond availability loss (Feedly).

The fix involves moving the LRU update from zs_map_object() to zs_malloc() in the zsmalloc subsystem. Patches have been submitted to the Linux stable kernel tree (commits d461aac924b9 and e95adf7486f2). Users should update to a patched Linux kernel version that includes these fixes. Distributions such as those tracked by Tenable (Nessus plugin 280772) should apply available kernel updates promptly (Feedly).