CVE-2023-54247: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54247 is a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the btf_type_id_size() function within kernel/bpf/btf.c. The issue involves an improper warning triggered when a DECL_TAG BTF type is used as a btf_key_type_id or btf_value_type_id during BPF map creation, causing a WARN_ON_ONCE to fire unnecessarily. It was published on December 30, 2025, and affects the Linux kernel. The EPSS score is approximately 0.022% (very low), and no CVSS score has been publicly assigned at this time (CVE Record).

The root cause is insufficient input validation in btf_type_id_size() in kernel/bpf/btf.c when processing BTF (BPF Type Format) type IDs supplied via the bpf_attr structure during a BPF_MAP_CREATE syscall. When bpf_attr.btf_key_type_id is set to a DECL_TAG type (e.g., type_id=1 in a crafted BTF blob), the function encounters a type that is neither a modifier nor a variable, triggering a WARN_ON_ONCE kernel warning. The fix silences this spurious warning by handling the DECL_TAG case gracefully — returning NULL without emitting a warning — since DECL_TAG types are legitimately invalid as map key/value type IDs. The vulnerability was discovered via syzbot fuzzing (CVE Record).

The primary impact is a kernel warning (WARN_ON_ONCE) being triggered, which in certain kernel configurations (e.g., panic_on_warn) could cause a kernel panic, leading to a denial of service. In standard configurations, the warning is non-fatal and the function correctly returns NULL, preventing the malformed BPF map from being created. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability in worst-case configurations (CVE Record).

The fix has been committed to the Linux kernel stable trees via patches at kernel/bpf/btf.c (commits 7c4f5ab63e79, 61f4bd46a03a, and e6c2f594ed96 in the stable repository). Users should update to a patched kernel version that includes these fixes. As a workaround, restricting unprivileged access to BPF syscalls via kernel.unprivileged_bpf_disabled=1 sysctl reduces exposure, though the vulnerability primarily requires local privileges regardless (Kernel Stable).