CVE-2023-54173: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54173 is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) subsystem, specifically in the bpf_event_output function. The flaw arises because nesting protection is used without disabling preemption, allowing a task to be preempted inside the nesting protection region and causing two tasks to share the same perf_sample_data buffer simultaneously. This results in kernel crashes, including NULL pointer dereferences. The vulnerability affects the Linux kernel and was published on December 30, 2025. It carries an estimated CVSS severity of Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is a race condition (CWE-362) in the Linux kernel's bpf_event_output function. When BPF programs are executed via bpf_prog_run_array_cg, migration is disabled but preemption remains enabled. This allows a preempting task to enter the same nesting-protected code path and concurrently use the same perf_sample_data buffer, leading to memory corruption and kernel NULL pointer dereferences. The fix disables preemption within bpf_event_output to ensure the nesting protection is effective. Patches are available in the stable kernel tree at multiple commits (Linux Kernel, Linux Kernel).

Successful exploitation of this vulnerability can cause a kernel crash (NULL pointer dereference) on affected Linux systems, resulting in a denial of service. The crash occurs in kernel mode during BPF program execution involving cgroup socket address hooks, as evidenced by the reported stack trace involving __cgroup_bpf_run_filter_sock_addr. There is no evidence of confidentiality or integrity impact beyond system availability loss; however, kernel crashes can disrupt all services running on the affected host (Feedly).

Apply the upstream Linux kernel patches that disable preemption within bpf_event_output. Fixes have been committed to the stable kernel tree across multiple branches (commits: 36dd8ca, 063c9ce, 3048cb0, c81bdf8, d62cc39). Linux distribution vendors (e.g., Red Hat, Ubuntu, SUSE) are expected to backport these fixes into their respective kernel packages; administrators should apply the latest kernel updates from their distribution. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Linux Kernel).