CVE-2023-54235: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54235 is a race condition vulnerability in the Linux kernel's PCI/DOE (Data Object Exchange) subsystem. The flaw involves an improper ordering of destroy_work_on_stack() and completion signaling in the doe_statemachine_work function, creating a use-after-free-style race condition. It was published on December 30, 2025, and affects Linux kernel versions introduced with commit abf04be0e707 up to the patched stable releases. Fixed versions include Linux 6.1.53, 6.4.16, 6.5.3, and 6.6. No CVSS score has been assigned; the EPSS score is approximately 0.023% (Feedly, EUVD).

The root cause is a race condition (CWE-362) in the Linux kernel's drivers/pci/doe.c. Specifically, destroy_work_on_stack() was called after signal_task_complete() in the calling thread, allowing the work_struct on the stack in pci_doe() to go out of scope before the workqueue infrastructure finished accessing it. The fix reorders operations so that destroy_work_on_stack() is called before signaling completion, which is safe because signal_task_complete() is the last action performed by the work item and the workqueue code does not access the work struct afterward. The bug manifests as a debug object warning (ODEBUG: free active object) triggered during PCI DOE state machine processing (Feedly).

Exploitation of this race condition could lead to kernel instability or a system crash (denial of service) due to the use of a freed stack-allocated work_struct. In edge cases, depending on timing and kernel configuration, it may also contribute to memory corruption in the kernel's workqueue subsystem. The impact is generally limited to availability, affecting systems with PCI DOE-capable hardware (e.g., systems using CMA/SPDM over PCIe) (Feedly).

The Linux kernel maintainers have addressed this vulnerability in stable releases 6.1.53, 6.4.16, 6.5.3, and 6.6 via upstream commits. The relevant patches are available at the kernel stable repository (commits 19cf3ba16dcc, c4f9c0a3a6df, d96799ee3b78, and e3a3a097eaeb). Users should update to a patched kernel version as soon as possible. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Feedly, EUVD).