CVE-2023-54172: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54172 is a vulnerability in the Linux kernel's x86/Hyper-V subsystem where the hypercall page lacks an ENDBR64 instruction, causing kernel panics on hardware with Indirect Branch Tracking (IBT) support. On Hyper-V VMs with ConfigVersion 9.3 or later, IBT is enabled in the guest, but the Hyper-V hypercall page does not begin with the required ENDBR64 instruction. Since hypercalls are made via indirect calls to the hypercall page, all hypercall attempts trigger an IBT exception, resulting in a Linux kernel panic. The vulnerability was published on December 30, 2025, and affects the Linux kernel across multiple stable branches. The CVSS base score is 0.0 as assigned by ENISA, reflecting its nature as a stability/availability issue rather than a traditional security exploit (EUVD).

The root cause is a missing ENDBR64 instruction at the start of the Hyper-V hypercall page, which violates the requirements of Intel's Indirect Branch Tracking (IBT) security feature (related to CWE-670: Always-Incorrect Control Flow Implementation). When IBT is active, any indirect call must target an instruction marked with ENDBR; the absence of this marker causes a control-flow enforcement exception. The Linux kernel fix addresses this by detecting whether the hypercall page starts with an ENDBR instruction and, if not, clearing the X86_FEATURE_IBT CPU feature flag so the VM can boot and operate without IBT enabled. Patches were applied to stable kernel branches at commits 98cccbd0a19a, 73626b70b361, and d5ace2a77644 (Kernel Git, Kernel Git, Kernel Git).

The primary impact of this vulnerability is a denial of service: Linux guests running on Hyper-V with ConfigVersion 9.3 or later on IBT-capable hardware will kernel panic upon any hypercall attempt, rendering the VM completely non-functional. There is no known confidentiality or integrity impact, as the vulnerability does not enable code execution or data exfiltration. The affected scope is limited to x86 Linux VMs hosted on Hyper-V with IBT hardware support and the relevant ConfigVersion (EUVD).

Update the Linux kernel to a patched version: 6.5 or later, 6.4.10 or later, or 6.1.45 or later, which include the fix that disables IBT when the Hyper-V hypercall page lacks an ENDBR64 instruction. As a temporary workaround, disabling IBT at the kernel command line (e.g., ibt=off) on affected Hyper-V guests can prevent the panic until a patched kernel is deployed. A Hyper-V-side fix to add ENDBR64 to the hypercall page was also in progress at the time of disclosure (Kernel Git, EUVD).