CVE-2023-54244: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54244 is a use-after-free / kernel oops vulnerability in the Linux kernel's ACPI Embedded Controller (EC) subsystem. It occurs when removing custom query handlers while the EC query workqueue may still be executing the associated callback, potentially causing a kernel oops if the module holding the callback has already been unloaded. The vulnerability was published on December 30, 2025, and affects the Linux kernel across multiple stable branches. Patched versions include 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4. The EPSS score is approximately 0.024% (very low), and no CVSS score has been formally assigned (Feedly, ENISA EUVD).

The root cause is a race condition (CWE-362) in the ACPI EC subsystem's custom query handler removal path. When a kernel module registers a custom EC query handler and is subsequently unloaded, the handler removal function does not wait for any in-progress workqueue callbacks to complete before freeing the handler structure. This means the EC query workqueue can dereference a function pointer belonging to an already-unloaded module, resulting in a kernel oops (invalid memory access). The fix involves flushing the EC query workqueue (flush_workqueue()) before removing the handler, ensuring all pending callbacks have completed. The fix was tested on an Acer Travelmate 4002WLMi (Feedly, ENISA EUVD).

Successful triggering of this vulnerability causes a kernel oops, which typically results in a system crash or kernel panic, impacting availability. Because the oops occurs in kernel context due to execution of code from an unloaded module, it primarily affects system stability rather than confidentiality or integrity. The impact is local and limited to the host system; there is no known path to privilege escalation or remote code execution based on available information (Feedly).

Apply the upstream Linux kernel patches that introduce a flush_workqueue() call in the EC query handler removal path. Fixed versions are available across multiple stable branches: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4. Users should update to the patched kernel version appropriate for their distribution. As a workaround, avoiding the dynamic loading and unloading of kernel modules that register custom ACPI EC query handlers can reduce exposure (ENISA EUVD).