CVE-2023-54312: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54312 is a buffer overflow vulnerability in the Linux kernel's BPF sample code, specifically in the tcp_basertt program under samples/bpf/. The flaw results from incorrect buffer size calculation — using sizeof(nv) pointer size rather than the correct sizeof(*nv) or strlen(nv)+1 — leading to a potential buffer overflow condition. It affects Linux kernel versions from commit c890063e440456e75c2e70f6bcec3797f1771eb6 up to the respective fix commits across multiple stable branches. The vulnerability was published on December 30, 2025, and is estimated as Medium severity with no official CVSS score assigned at time of publication (Feedly, ENISA EUVD).

The root cause is a classic buffer overflow (CWE-120/CWE-131) in the samples/bpf/tcp_basertt_kern.c or associated user-space sample code, where an incorrect size argument is passed to a buffer operation involving the variable nv. Using sizeof(nv) on a pointer yields the pointer's size (typically 4 or 8 bytes) rather than the size of the pointed-to buffer, allowing data to overflow the allocated region. The fix, applied across multiple stable kernel branches, corrects the size argument to use sizeof(*nv) or strlen(nv)+1 as appropriate. Because this code resides in the samples/bpf/ directory (sample/demonstration code rather than core kernel code), exploitation would require a local user to compile and run the affected sample program (Feedly, ENISA EUVD).

The buffer overflow in the tcp_basertt BPF sample could lead to memory corruption if the affected sample program is compiled and executed on a vulnerable kernel. Potential consequences include crashes of the sample process or, in a worst-case scenario, memory corruption that could affect adjacent data structures. Given that the vulnerable code is in sample/demonstration code rather than production kernel paths, the practical impact is limited and does not directly affect the kernel's core attack surface (Feedly).

Patches have been applied to multiple Linux stable kernel branches. Fixed versions include Linux 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5 (mainline). Administrators should update to a patched kernel version. As the vulnerability resides in sample/demonstration code (samples/bpf/), organizations that do not compile or deploy BPF sample programs are not exposed to practical risk from this issue (ENISA EUVD, Feedly).