CVE-2023-54283: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54283 is a data race vulnerability in the Linux kernel's BPF LRU list implementation (bpf_lru_list). It was reported by the Kernel Concurrency Sanitizer (KCSAN) and involves unsynchronized concurrent access to the node->ref field in bpf_lru_list.c. The vulnerability affects the Linux kernel and was published on December 30, 2025. Feedly estimates the severity as Medium, with an EPSS score of 0.00032 (Feedly).

The root cause is a data race (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the BPF LRU list subsystem of the Linux kernel. KCSAN detected concurrent unsynchronized reads and writes to node->ref — specifically, a write in __bpf_lru_node_move (called via __bpf_lru_list_rotate) racing with a read in __htab_lru_percpu_map_update_elem. The fix replaces bare accesses with READ_ONCE()/WRITE_ONCE() patterns and introduces a new bpf_lru_node_clear_ref() helper to perform WRITE_ONCE(node->ref, 0) consistently (Feedly). The affected code paths include kernel/bpf/bpf_lru_list.c and kernel/bpf/hashtab.c.

The data race in the BPF LRU list can lead to undefined behavior due to unsynchronized memory accesses in the kernel. While the node->ref field does not need to be strictly accurate for correctness in all cases, the race condition could result in memory corruption, incorrect LRU eviction decisions, or kernel instability. The practical impact is primarily an availability risk (potential kernel panic or unpredictable behavior) on systems using BPF hash maps with LRU eviction (Feedly).

The Linux kernel maintainers have addressed this vulnerability by applying patches that replace unprotected accesses to node->ref with READ_ONCE()/WRITE_ONCE() macros and adding the bpf_lru_node_clear_ref() helper. Fixes are available in multiple stable kernel branches via commits to git.kernel.org (e.g., commits 6e5e83b, 6eaef1b, 819ca25, a89d144, b6d9a40). Users should update to a patched Linux kernel version as provided by their distribution vendor (Feedly).