CVE-2023-54160 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_sdei: Fix sleep from invalid context BUG
Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra triggers:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0 preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by cpuhp/0/24: #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
#1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
#2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130
irq event stamp: 36 hardirqs last enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0
hardirqs last disabled at (36): [<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248
softirqs last enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0
softirqs last disabled at (0): [<0000000000000000>] 0x0
CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]
Hardware name: WIWYNN Mt.Jade Server [...]
Call trace: dump_backtrace+0x114/0x120 show_stack+0x20/0x70 dump_stack_lvl+0x9c/0xd8 dump_stack+0x18/0x34 __might_resched+0x188/0x228 rt_spin_lock+0x70/0x120 sdei_cpuhp_up+0x3c/0x130 cpuhp_invoke_callback+0x250/0xf08 cpuhp_thread_fun+0x120/0x248 smpboot_thread_fn+0x280/0x320 kthread+0x130/0x140 ret_from_fork+0x10/0x20
sdei_cpuhp_up() is called in the STARTING hotplug section, which runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry instead to execute the cpuhp cb later, with preemption enabled.
SDEI originally got its own cpuhp slot to allow interacting with perf. It got superseded by pNMI and this early slot is not relevant anymore. [1]
Some SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the calling CPU. It is checked that preemption is disabled for them. _ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'. Preemption is enabled in those threads, but their cpumask is limited to 1 CPU. Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb don't trigger them.
Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call which acts on the calling CPU.
[1]:
https://lore.kernel.org/all/[email protected]/
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability CVE-2023-54160 resides within the Linux kernel's firmware handling mechanism, specifically in the ARM SDEI (Secure Deferred Event Interrupt) subsystem. This issue manifests when a preempt-rt enabled kernel executes on Ampere Altra hardware, triggering a critical kernel bug due to improper context handling during CPU hotplug operations. The problem stems from the sdei_cpuhp_up() function being invoked in the STARTING hotplug section, which executes with interrupts disabled, violating kernel safety protocols that require certain operations to occur in contexts where preemption is enabled.
The technical flaw occurs when the SDEI subsystem attempts to perform locking operations within an invalid execution context. The kernel's locking infrastructure detects this anomaly through the rt_spin_lock function call which fails because the code path executes with interrupts disabled but requires preemption to be enabled for proper operation. The stack trace reveals that the issue originates from cpuhp_thread_fun which is part of the CPU hotplug thread execution mechanism, where the sdei_cpuhp_up function is called with a CPUHP_AP_ONLINE_DYN entry that should execute later when preemption is properly enabled. This design conflict between the legacy SDEI hotplug slot mechanism and the modern preempt-rt kernel requirements creates a race condition that can lead to system instability.
The operational impact of this vulnerability is significant, particularly in real-time computing environments where the preempt-rt kernel is essential for deterministic behavior. The bug can cause kernel panics and system crashes when the firmware subsystem attempts to handle SDEI events during CPU hotplug operations. The vulnerability affects systems running Linux kernel versions with preempt-rt support on ARM-based platforms, specifically targeting the Ampere Altra architecture. The flaw is particularly dangerous because it can occur during normal system operation when CPUs are being brought online, potentially leading to complete system failure or data corruption in embedded systems that rely on real-time responsiveness.
The mitigation strategy involves changing the SDEI CPU hotplug registration mechanism from a STARTING context to a CPUHP_AP_ONLINE_DYN entry, which ensures execution occurs in a context with proper preemption enabled. This approach aligns with the ATT&CK framework's system binary proxying techniques where kernel-level modifications are required to prevent privilege escalation through improper context handling. The fix also includes adding proper checks for SDEI function calls that operate on the calling CPU, specifically addressing the SDEI_1_0_FN_SDEI_PRIVATE_RESET function. This modification addresses the underlying CWE-362 weakness related to improper locking mechanisms and concurrent execution contexts, ensuring that the SDEI subsystem can properly integrate with modern real-time kernel features while maintaining system stability and security.
The solution effectively addresses the root cause by reorganizing the execution context for SDEI operations to align with kernel design principles for real-time systems. The fix moves away from the legacy CPU hotplug slot that was originally designed for performance monitoring integration but has since been superseded by pNMI mechanisms. This change ensures that SDEI callbacks execute in appropriate contexts where preemption is enabled, preventing the kernel from triggering BUG_ON conditions that would otherwise result in system crashes. The implementation also includes additional validation for specific SDEI functions that require CPU-local operations, providing comprehensive protection against similar issues that might arise from improper context usage in the firmware subsystem.