CVE-2023-54278: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54278 is a vulnerability in the Linux kernel's s390 virtual memory (vmem) subsystem that causes a kernel crash (addressing exception) during early boot when debug pagealloc is enabled. The root cause is that large memory mappings (using EDAT1/EDAT2 features) are not split into 4K pages before debug pagealloc operations are performed, leading to a fatal kernel panic. It was published on December 30, 2025, and affects Linux kernel versions on s390 architecture following commit bb1520d581a3 ("s390/mm: start kernel with DAT enabled"). The CVSS category is estimated as Medium, with an EPSS score of 0.000180 (Feedly, CVE.org).

The vulnerability is classified under improper handling of memory page mappings in the s390 architecture's virtual memory subsystem (CWE-703/improper handling of exceptional conditions). Since commit bb1520d581a3 introduced DAT (Dynamic Address Translation) enabled kernel startup, the kernel uses large page mappings (via EDAT1/EDAT2) for memory regions. When debug pagealloc is enabled, the __kernel_map_pages() function attempts to manipulate page table entries (via ipte instructions) on these large mappings, which is not supported — triggering an addressing exception (0005) and subsequent kernel panic. The fix involves adding logic to split large mappings into 4K pages when debug pagealloc is active, as referenced in kernel commits 601e467e29a9 and edc1e4b6e265 (Feedly, kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability results in a kernel panic during early boot, causing a complete denial of service (system unavailability) on affected s390 systems. The crash occurs before the system is fully initialized, meaning the system cannot boot at all when debug pagealloc is enabled on hardware supporting EDAT1/EDAT2. There is no known confidentiality or integrity impact — the primary consequence is availability loss (Feedly).

The fix is available as upstream Linux kernel patches in commits 601e467e29a9 and edc1e4b6e265, which add logic to split large s390 memory mappings into 4K pages when debug pagealloc is enabled. Administrators should apply the relevant stable kernel updates that include these patches. As a workaround, disabling debug pagealloc (a debug/development feature not typically enabled in production kernels) will prevent the crash (kernel.org patch 1, kernel.org patch 2).