CVE-2023-54322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54322 is a vulnerability in the Linux kernel affecting arm64 architecture, specifically related to incorrect IRQ entry text section handling when CONFIG_FUNCTION_GRAPH_TRACER is not enabled. Without this configuration, gic_handle_irq (the arm64 IRQ entry point) is not placed between __irqentry_text_start and __irqentry_text_end, causing filter_irq_stacks() and in_irqentry_text() to malfunction. This can result in unintentionally deep call stack entries, particularly in KASAN-enabled kernels, potentially triggering stack depot capacity exhaustion. The CVE was published on December 30, 2025, and is estimated as Medium severity with an EPSS score of 0.000180 (Feedly, CVE.org).

The root cause is a missing annotation: on arm64, gic_handle_irq (the IRQ entry point) is not marked with __irq_entry (or __exception_irq_entry) unless CONFIG_FUNCTION_GRAPH_TRACER is enabled, which is the only mechanism that otherwise places it in the __irqentry_text section. As a result, in_irqentry_text() — called by filter_irq_stacks() — cannot identify the IRQ entry boundary in the call stack, leading to stack frames not being properly trimmed. This is classified under improper resource management or incorrect annotation logic (no specific CWE has been formally assigned). The fix involves setting __exception_irq_entry with __irq_entry as a default on arm64 so that gic_handle_irq is always included in the __irqentry_text section regardless of tracer configuration (Feedly, kernel.org patch).

The primary impact is an availability issue: affected arm64 Linux kernels (especially with KASAN enabled) may experience stack depot capacity exhaustion, triggering kernel warnings (WARNING: CPU: X PID: X at lib/stackdepot.c:129 __stack_depot_save) and potentially causing system instability or denial of service. Confidentiality and integrity are not directly impacted, as this is a kernel bookkeeping/stack management defect rather than a memory corruption or privilege escalation vulnerability. The issue is most pronounced in development, testing, or security-hardened environments where KASAN is active (Feedly).

The fix is to apply the upstream Linux kernel patch that sets __exception_irq_entry with __irq_entry as a default on arm64, ensuring gic_handle_irq is always placed in the __irqentry_text section. Multiple stable kernel commits address this issue (e.g., 0bd309f22663, 47d74b54180b, c71d6934c6ac, d3b219e504fc, f6794950f0e5). Users should update to a patched kernel version as provided by their Linux distribution. As a short-term workaround, enabling CONFIG_FUNCTION_GRAPH_TRACER in the kernel configuration will also place gic_handle_irq in the correct section, mitigating the issue (kernel.org patch).