CVE-2023-54268: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54268 is a Linux kernel vulnerability in the debugobjects subsystem where fill_pool() incorrectly uses GFP_ATOMIC (which includes __GFP_KSWAPD_RECLAIM) for memory allocation, potentially waking up kswapd and acquiring kswapd_wait::lock in an unsafe context. This can trigger a lockdep warning (deadlock detection) when fill_pool() is called while arbitrary locks are already held. The vulnerability affects the Linux kernel from version 2.6.26 up to the patched stable releases. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is an improper use of the GFP_ATOMIC memory allocation flag in the fill_pool() function within the Linux kernel's debugobjects subsystem. GFP_ATOMIC expands to (__GFP_HIGH | __GFP_KSWAPD_RECLAIM), and the __GFP_KSWAPD_RECLAIM flag causes the kernel to attempt to wake up the kswapd memory reclaim daemon, which in turn tries to acquire kswapd_wait::lock. Because fill_pool() can be invoked with arbitrary locks already held by the caller, this lock acquisition is not guaranteed to be safe and can result in a lockdep-detected potential deadlock. The fix replaces GFP_ATOMIC with __GFP_HIGH and removes the now-redundant __GFP_NORETRY flag, which is meaningless for non-direct-reclaim allocations. This issue was originally identified by syzbot, the Linux kernel's automated fuzzing infrastructure (Feedly).

The primary impact of this vulnerability is a potential kernel deadlock or lockdep warning, which could lead to system instability or a kernel panic (denial of service) on affected Linux systems. There is no evidence of confidentiality or integrity impact, as the flaw is confined to an internal kernel locking issue within the debug object tracking subsystem. The availability impact is limited to scenarios where the deadlock condition is triggered, potentially causing the affected system to hang or crash (Feedly, EUVD).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include 5.4.244, 5.10.181, 5.15.114, 6.1.31, 6.3.5, and 6.4. Users should update their Linux kernel to one of these patched stable releases. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (EUVD, Kernel Patch 1, Kernel Patch 2).