CVE-2023-54211: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54211 is a kernel tracing subsystem vulnerability in the Linux kernel that causes a warning (and potential denial of service) in trace_buffered_event_disable(). The flaw arises from an imbalance where trace_buffered_event_enable() is called once but trace_buffered_event_disable() is called twice under specific ftrace event probe registration and deregistration sequences. It was published on December 30, 2025, and affects the Linux kernel. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a reference-counting imbalance in the Linux kernel's ftrace/tracing subsystem (CWE-691: Insufficient Control Flow Management). Specifically, in __ftrace_event_enable_disable(), the SOFT_DISABLED_BIT can be set a second time after being cleared (e.g., by triggering the traced function via cat /proc/cmdline), causing trace_buffered_event_disable() to be invoked a second time without a corresponding trace_buffered_event_enable() call, which triggers WARN_ON_ONCE(!trace_buffered_event_ref). The fix involves ensuring trace_buffered_event_enable() is called only on the first soft-mode enable and trace_buffered_event_disable() only on the last soft-mode disable. Exploitation requires local access and the ability to write to the kernel tracing filesystem (/sys/kernel/tracing/) (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a kernel warning (WARN_ON_ONCE) in trace_buffered_event_disable(), which can cause system instability or a kernel panic depending on the configuration, leading to a denial of service (availability impact: High). There is no confidentiality or integrity impact. The scope is limited to the local system, and there is no known potential for lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

The fix has been committed to the Linux kernel stable tree across multiple stable branches (patches available at git.kernel.org). Users should update to a patched kernel version that includes the fix for trace_buffered_event_disable(). As a workaround, restricting access to the kernel tracing filesystem (/sys/kernel/tracing/) to privileged users only can reduce exposure. Red Hat has tracked this issue in Bugzilla with low priority/severity (Red Hat Bugzilla, Upstream Advisory).