CVE-2023-54246: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54246 is a vulnerability in the Linux kernel's RCU (Read-Copy-Update) scale testing module (rcuscale). Specifically, the rcu_scale_writer() kthread uses schedule_timeout_uninterruptible() during its holdoff delay, which causes the hung-task watchdog to trigger a false positive when the rcuscale.holdoff module parameter is set to a value greater than hung_task_timeout_secs. The fix moves the sleep call to use an idle-compatible mechanism to avoid the hung-task timeout. The vulnerability was published on December 30, 2025, and affects the Linux kernel (CVE Record). No CVSS score has been publicly assigned at this time.

The root cause is an improper use of schedule_timeout_uninterruptible() within the rcu_scale_writer() kthread in the Linux kernel's rcuscale test module. When the rcuscale.holdoff parameter specifies a delay longer than the system's hung_task_timeout_secs, the kernel's hung-task detector incorrectly flags the rcu_scale_write task as blocked (state D — uninterruptible sleep) for too long, generating a spurious warning. The fix relocates the schedule_timeout_uninterruptible() call to an idle context (_idle()) so the hung-task watchdog does not trigger. This is classified as an availability/stability issue rather than a security exploit vector (CVE Record).

The primary impact of this vulnerability is a false hung-task kernel warning that can cause unnecessary alarm and potentially disrupt diagnostic or testing workflows on systems using the rcuscale kernel module with a large holdoff parameter. There is no evidence of confidentiality or integrity impact; the issue is limited to availability in the form of spurious kernel log messages and potential system instability in testing environments. Production systems not using the rcuscale module parameter are not affected (CVE Record).

The fix has been applied to the Linux kernel stable tree via multiple commits (e.g., commits 4f03fba, 83ed0cd, 9416dcb, 55887ad, e60c122 on kernel.org). Users should update to a patched kernel version that includes the fix for rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle(). As a workaround, avoid setting rcuscale.holdoff to a value greater than hung_task_timeout_secs, or increase hung_task_timeout_secs via /proc/sys/kernel/hung_task_timeout_secs to suppress the false positive (CVE Record).