CVE-2023-54303: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54303 is a race condition vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the bpf_perf_event_output function. The flaw arises because the nesting protection mechanism in bpf_perf_event_output assumes preemption is disabled, which holds true for kprobes and tracepoints, but not for uprobes — where bpf_prog_run_array_sleepable disables migration while keeping preemption enabled. Affected versions include Linux kernel releases prior to the patches applied in stable branches (6.1.45, 6.4.10, and 6.5). The vulnerability was published on December 30, 2025, with an EPSS score of 0.017% (Low), and no CVSS base score has been formally assigned (Feedly, ENISA EUVD).

The root cause is a concurrency/race condition (CWE-362) in the Linux kernel's bpf_perf_event_output helper function. When invoked from a uprobe context via bpf_prog_run_array_sleepable, the function's nesting protection — which relies on per-CPU state — can be violated because preemption remains enabled. A preempted task can be scheduled out mid-execution, allowing another task to concurrently use the same perf_sample_data buffer, leading to memory corruption. The resulting crash manifests as a kernel page fault attempting to execute an NX-protected page, as evidenced by the call trace involving perf_output_sample, bpf_perf_event_output, and uprobe_dispatcher. The fix disables preemption within bpf_perf_event_output to enforce the same guarantees present in kprobe/tracepoint contexts (Feedly, ENISA EUVD).

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) due to two tasks concurrently writing to the same perf_sample_data buffer, resulting in memory corruption. The crash manifests as a kernel BUG with an inability to handle a page fault at an NX-protected address, effectively crashing the affected system. While the primary impact is availability (system crash), the memory corruption scenario could theoretically be leveraged for privilege escalation on systems where a local user can load BPF programs and attach uprobes, though no such exploitation has been demonstrated publicly (Feedly).

The Linux kernel maintainers have addressed this vulnerability by disabling preemption within bpf_perf_event_output to ensure consistent nesting protection regardless of the calling context. Patches have been applied to stable kernel branches: 6.1.45, 6.4.10, and 6.5. Users should update to these patched versions or any later stable release. The relevant upstream commits are 3654ed5daf492463c3faa434c7000d45c2da2ace, a0ac32cf61e5a76e2429e486925a52ee41dd75e3, and f2c67a3e60d1071b65848efaa8c3b66c363dd025 (ENISA EUVD). As a workaround where patching is not immediately possible, restricting unprivileged access to BPF program loading (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl) reduces exposure.