CVE-2023-54242: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54242 is a division-by-zero vulnerability in the Linux kernel's BFQ (Budget Fair Queueing) I/O scheduler. It occurs in the bfqq_request_over_limit function when the weighted sum (wsum) is zero, causing a kernel oops (divide error). The vulnerability was published on December 30, 2025, and affects Linux kernel versions using the BFQ block scheduler. It carries a low EPSS score of 0.017%, indicating limited exploitation likelihood (Feedly).

The root cause is a missing zero-check before a division operation in the BFQ I/O scheduler's bfqq_request_over_limit function (CWE-369: Divide By Zero). When the weighted sum (wsum) evaluates to zero — triggerable by running stress-ng --ioprio 0 as root — the kernel attempts to divide by zero, resulting in a fatal divide error oops. The crash occurs at bfqq_request_over_limit+0x207/0x400 in the block layer code. The fix skips the limit calculation and continues to the next level when wsum is zero (Feedly).

Successful triggering of this vulnerability causes a kernel panic (divide error oops), resulting in a system crash and denial of service. The impact is limited to availability — there is no evidence of code execution, privilege escalation, or data exfiltration potential. Only processes with root privileges can trigger the condition, which significantly limits the attack surface (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2023-54242. The vulnerability requires local root access to trigger via a specific I/O priority configuration (e.g., stress-ng --ioprio 0), making remote exploitation infeasible. The EPSS score is 0.017% (0.000170), reflecting very low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Gain root access: Obtain root-level access to a Linux system running a vulnerable kernel with the BFQ I/O scheduler enabled.
2. Trigger zero weighted sum: Execute a workload that sets I/O priority in a way that results in a zero weighted sum in the BFQ scheduler, for example: stress-ng --ioprio 0
3. Observe kernel oops: The kernel will encounter a divide-by-zero error in bfqq_request_over_limit+0x207/0x400, producing a kernel oops and potentially crashing the system (Feedly).

• Logs: Kernel log entries containing divide error: 0000 [#1] SMP NOPTI and references to bfqq_request_over_limit+0x207/0x400 in /var/log/kern.log or dmesg output.
• Process: Presence of stress-ng or similar I/O stress tools running with --ioprio 0 arguments under a root-owned process.
• System: Unexpected system reboots or kernel panics on systems using the BFQ I/O scheduler (Feedly).

Apply the upstream Linux kernel patches that add a zero-check for wsum before the division in bfqq_request_over_limit. The fixes are available in the stable kernel tree at commits 1655cfc85250, c0346a59d719, and e53413f8deed. Linux distribution vendors including SUSE have issued updated kernel packages incorporating this fix. As a workaround, avoid using the BFQ I/O scheduler on systems where untrusted root-level users can run I/O priority tools, or switch to an alternative scheduler (e.g., mq-deadline or none) (Feedly, Linux Security).