CVE-2023-54086

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-54086
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54086.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-54086
Downstream
Published
2025-12-24T13:06:16.857Z
Modified
2026-04-02T09:45:34.484377Z
Summary
bpf: Add preempt_count_{sub,add} into btf id deny list
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add preemptcount{sub,add} into btf id deny list

The recursion check in __bpfprogenter* and __bpfprogexit* leave preemptcount{sub,add} unprotected. When attaching trampoline to them we get panic as follows,

[ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asmexcint3+0x3a/0x40 [ 867.843108] RIP: 0010:preemptcountsub+0x1/0xa0 [ 867.843135] __bpfprogenter_recur+0x17/0x90 [ 867.843148] bpftrampoline64424681080+0x2e/0x1000 [ 867.843154] ? preemptcountsub+0x1/0xa0 [ 867.843157] preemptcountsub+0x5/0xa0 [ 867.843159] ? migrateenable+0xac/0xf0 [ 867.843164] __bpfprogexit_recur+0x2d/0x40 [ 867.843168] bpftrampoline64424681080+0x55/0x1000 ... [ 867.843788] preemptcountsub+0x5/0xa0 [ 867.843793] ? migrateenable+0xac/0xf0 [ 867.843829] __bpfprogexitrecur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpftrampoline64424681080+0x55/0x1000 ...

That is because in _bpfprogexitrecur, the preemptcount{sub,add} are called after prog->active is decreased.

Fixing this by adding these two functions into btf ids deny list.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54086.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
35e3815fa8102fab4dee75f3547472c66581125d
Fixed
095018267c87b8bfbbb12eeb1c0ebf2359e1782c
Fixed
60039bf72f81638baa28652a11a68e9b0b7b5b2d
Fixed
b9168d41b83d182f34ba927ee822edaee18d5fc8
Fixed
c11bd046485d7bf1ca200db0e7d0bdc4bafdd395
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f5e770c0c60ab8812574a2e0d163b0efa816a825

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54086.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.15.113
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.30
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.3.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54086.json"