CVE-2023-54167: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54167 is a Linux kernel vulnerability affecting the m68k architecture's memory management subsystem, specifically in the handling of initrd (initial ramdisk) physical-to-virtual address translation during boot. The flaw occurs when phys_to_virt() is called before paging_init() completes on platforms where physical memory does not start at address zero (e.g., Amiga hardware), causing a kernel oops due to an invalid virtual address access. It affects Linux kernel versions from commit 376e3fdecb0d up to the fixes applied in versions 6.1.20, 6.2.7, and 6.3. The CVE was published on December 30, 2025, with a CVSS base score of 0.0 (no severity assigned) and an EPSS score of 0.024% (Feedly, EUVD).

The root cause is an improper ordering of initialization calls in the m68k memory management code (CWE-908: Use of Uninitialized Resource). On m68k platforms where physical memory does not begin at address zero, phys_to_virt() depends on m68k_memoffset and module_fixup(), which are only properly set up after paging_init() runs. Calling phys_to_virt() for the initrd address range before paging_init() results in an invalid virtual address dereference, triggering a kernel oops (Unable to handle kernel access at virtual address) during the memcmp operation. The fix moves the phys_to_virt handling for the initial ramdisk to after paging_init() is called, and replaces #ifdef preprocessor guards with IS_ENABLED() for cleaner code (Feedly).

Exploitation of this vulnerability results in a kernel panic (oops) during system boot on affected m68k hardware platforms (such as Amiga) when an initial ramdisk is used and physical memory does not start at address zero. The primary impact is a denial of service — the system fails to boot successfully, rendering it completely unavailable. There is no known confidentiality or integrity impact, and the vulnerability is limited to the specific m68k architecture boot path (Feedly).

This vulnerability has a very low exploitability profile, with an EPSS score of approximately 0.024% and no known public exploit code, active in-the-wild exploitation, or threat actor attribution. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is triggered locally during the boot process on niche m68k hardware and does not represent a remotely exploitable attack surface (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable versions 6.1.20, 6.2.7, and 6.3. The fix is available via the following upstream commits: ceb089e2337f (for one stable branch), 58662cfb4591 (for another), and d4b97925e87e (for a third). Users running affected m68k kernel versions should update to the patched releases. As a workaround, avoiding the use of an initial ramdisk (initrd) on affected m68k platforms (where physical memory does not start at address zero) would prevent the crash (Feedly).