CVE-2023-54173 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable preemption in bpf_event_output
We received report [1] of kernel crash, which is caused by
using nesting protection without disabled preemption.
The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled.
This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like:
BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ? __x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
Fixing this by disabling preemption in bpf_event_output.
[1] https://github.com/cilium/cilium/issues/26756
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability CVE-2023-54173 represents a critical preemption race condition within the Linux kernel's eBPF subsystem that can lead to kernel crashes and system instability. This issue specifically affects the bpf_event_output function which is responsible for handling event output operations in eBPF programs. The vulnerability manifests when bpf_event_output is invoked through the bpf_prog_run_array_cg function, creating a scenario where nesting protection mechanisms are in place but preemption remains enabled. This combination creates a dangerous race condition where a task can be preempted by another task while holding the nesting protection, potentially allowing multiple tasks to access the same perf_sample_data buffer simultaneously.
The technical flaw stems from insufficient synchronization mechanisms within the kernel's eBPF execution environment. When bpf_prog_run_array_cg disables migration but leaves preemption enabled, it creates a window where the kernel scheduler can interrupt the current execution context. This interruption occurs within the critical section protected by nesting mechanisms, leading to concurrent access of shared kernel data structures. The perf_sample_data buffer becomes a shared resource that multiple execution contexts attempt to modify simultaneously, resulting in memory corruption and ultimately kernel NULL pointer dereferences. The stack trace reveals the execution path leading to the crash, showing the cascade from bpf_event_output through perf_event_output to perf_output_sample, where the actual memory corruption occurs.
The operational impact of this vulnerability is severe as it can cause complete system crashes and kernel panics, particularly in environments heavily utilizing eBPF programs such as network security solutions, observability platforms, and container orchestration systems. The vulnerability affects systems running Linux kernels where eBPF is actively used for socket filtering, network monitoring, and security policy enforcement. Given that eBPF is increasingly deployed in production environments through projects like Cilium for network policy enforcement, this vulnerability represents a significant risk to system stability and availability. The crash pattern described in the vulnerability report indicates a direct memory corruption issue that can be exploited to cause denial of service conditions or potentially more serious security implications if attackers can manipulate the execution context to trigger specific memory access patterns.
The mitigation for CVE-2023-54173 involves implementing proper preemption disabling within the bpf_event_output function as specified in the kernel patch. This solution follows established kernel development practices for handling race conditions and ensures that when nesting protection mechanisms are active, preemption is properly disabled to prevent the scenario where multiple tasks can concurrently access shared kernel resources. The fix aligns with the principles outlined in the Common Weakness Enumeration (CWE) category CWE-362, which addresses Race Conditions, and follows the ATT&CK framework's approach to kernel-level vulnerabilities under the Tactic of Privilege Escalation and Defense Evasion. The solution demonstrates proper kernel synchronization practices that prevent concurrent access to critical data structures while maintaining system performance and responsiveness. Organizations should apply the kernel patches immediately and monitor systems for any signs of instability during the update process, particularly in production environments where eBPF is extensively utilized for network and security operations.