CVE-2023-54247 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
bpf: Silence a warning in btf_type_id_size()
syzbot reported a warning in [1] with the following stacktrace:
WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... Call Trace: <TASK> map_check_btf kernel/bpf/syscall.c:1024 [inline]
map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198 __sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040 __do_sys_bpf kernel/bpf/syscall.c:5162 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5160 [inline]
__x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
With the following btf [1] DECL_TAG 'a' type_id=4 component_idx=-1
[2] PTR '(anon)' type_id=0
[3] TYPE_TAG 'a' type_id=2
[4] VAR 'a' type_id=3, linkage=static
and when the bpf_attr.btf_key_type_id = 1 (DECL_TAG), the following WARN_ON_ONCE in btf_type_id_size() is triggered: if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) && !btf_type_is_var(size_type))) return NULL;
Note that 'return NULL' is the correct behavior as we don't want a DECL_TAG type to be used as a btf_{key,value}_type_id even
for the case like 'DECL_TAG -> STRUCT'. So there is no correctness issue here, we just want to silence warning.
To silence the warning, I added DECL_TAG as one of kinds in btf_type_nosize() which will cause btf_type_id_size() returning NULL earlier without the warning.
[1] https://lore.kernel.org/bpf/[email protected]/
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54247 addresses a warning condition in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically within the BTF (BPF Type Format) type handling mechanism. This issue manifests as a spurious warning message during BPF map creation operations when processing certain BTF type definitions that include DECL_TAG types. The warning originates from the btf_type_id_size() function located in kernel/bpf/btf.c at line 1988, where an incorrect assumption about type validation triggers an unnecessary warning even though the system behavior remains correct.
The technical flaw occurs when a BPF program attempts to create a map using a BTF key type identifier that references a DECL_TAG type. The system processes a specific BTF structure containing a DECL_TAG with type_id=4, followed by a PTR type with type_id=0, a TYPE_TAG referencing the PTR, and finally a VAR type with linkage=static. When the bpf_attr.btf_key_type_id is set to 1, corresponding to the DECL_TAG type, the btf_type_id_size() function encounters a condition where it evaluates whether the type is a modifier or variable type. The check fails for DECL_TAG types, causing the WARN_ON_ONCE macro to trigger and produce a warning message in the kernel log.
This vulnerability operates under the context of BPF's type validation system where BTF types are used to define the structure of data accessed by BPF programs. The issue does not represent a security vulnerability in terms of code execution or privilege escalation but rather a cosmetic warning that could clutter system logs and potentially mask more significant issues during debugging or security analysis. The problem is categorized under CWE-704 as incorrect type handling within kernel subsystems, and relates to the ATT&CK technique T1059.006 for execution through kernel modules or system calls.
The operational impact of this vulnerability is primarily limited to noisy logging that may confuse system administrators or security analysts monitoring kernel logs. The system behavior remains correct since the function properly returns NULL when encountering invalid type references, which is the expected behavior for DECL_TAG types that should not be used as key or value types in BPF maps. However, the warning message can obscure legitimate warnings that might occur during normal operation or indicate actual issues with BPF program compilation or execution.
The mitigation implemented for CVE-2023-54247 involves modifying the btf_type_nosize() function to recognize DECL_TAG types as non-sizeable, which causes the btf_type_id_size() function to return NULL earlier in the process without triggering the warning. This change prevents the spurious warning while maintaining all existing security and correctness properties of the BPF subsystem. The fix aligns with standard kernel development practices for handling edge cases in type validation systems and ensures that kernel logs remain clean and meaningful for system monitoring and debugging purposes. This resolution demonstrates proper handling of BTF type categorization and maintains the integrity of the BPF type system while eliminating unnecessary warning messages that could interfere with operational security monitoring.