CVE-2023-54244 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
ACPI: EC: Fix oops when removing custom query handlers
When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded.
Fix this by flushing the EC query workqueue when removing custom query handlers.
Tested on a Acer Travelmate 4002WLMi
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54244 represents a critical kernel-level issue within the Linux operating system's ACPI (Advanced Configuration and Power Interface) subsystem, specifically affecting the embedded controller implementation. This flaw manifests as a kernel oops condition that occurs during the dynamic removal of custom query handlers from the embedded controller interface. The root cause lies in the improper handling of workqueue operations when custom query handlers are being unloaded from memory, creating a race condition between the handler removal process and ongoing execution within the EC query workqueue.
The technical flaw stems from the asynchronous nature of the embedded controller query processing mechanism where custom query handlers may still be executing or referenced within the workqueue when the module containing the callback functions is being unloaded. This creates a dangling pointer scenario where the kernel attempts to execute code that no longer exists in memory, resulting in an immediate system crash or kernel oops. The vulnerability specifically impacts the ACPI embedded controller subsystem and demonstrates a classic improper resource management issue that violates fundamental kernel safety principles. According to CWE classification, this maps to CWE-415: Double Free and CWE-416: Use After Free, as the system attempts to access memory that has already been freed or unloaded.
The operational impact of this vulnerability extends beyond simple system stability concerns to potentially compromise the entire system reliability, particularly on devices that rely heavily on ACPI functionality for power management and hardware configuration. Systems running on affected hardware platforms, such as the Acer Travelmate 4002WLMi mentioned in the patch, face elevated risk of unexpected system crashes, particularly during dynamic module loading/unloading operations or system shutdown sequences. This vulnerability could be exploited by malicious actors to cause denial of service conditions or potentially facilitate more sophisticated attacks targeting kernel memory corruption. The issue affects systems where custom ACPI query handlers are dynamically loaded and unloaded, making it particularly relevant for enterprise environments that deploy custom hardware management solutions or systems with complex power management requirements.
The mitigation strategy for CVE-2023-54244 involves implementing proper synchronization mechanisms through workqueue flushing operations when removing custom query handlers from the embedded controller subsystem. The fix requires flushing the EC query workqueue before proceeding with handler removal, ensuring that all pending work items are completed or cancelled before the module memory is released. This approach aligns with ATT&CK framework technique T1059.006 for privilege escalation and T1490 for denial of service, as it addresses the underlying kernel memory management flaw that could be leveraged for system instability. System administrators should prioritize applying the kernel patches that implement this fix, particularly on devices that utilize custom ACPI handlers or dynamic module loading. The vulnerability highlights the importance of proper kernel memory management and workqueue synchronization, emphasizing that kernel-level components must account for asynchronous execution patterns when managing dynamic resources. Organizations should also consider implementing monitoring solutions to detect potential kernel oops conditions and ensure proper system stability in environments where ACPI-based power management is critical for operations.