CVE-2023-54278 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
s390/vmem: split pages when debug pagealloc is enabled
Since commit bb1520d581a3 ("s390/mm: start kernel with DAT enabled") the kernel crashes early during boot when debug pagealloc is enabled:
mem auto-init: stack:off, heap alloc:off, heap free:off addressing exception: 0005 ilc:2 [#1] SMP DEBUG_PAGEALLOC
Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0-rc3-09759-gc5666c912155 #630 [..]
Krnl Code: 00000000001325f6: ec5600248064 cgrj %r5,%r6,8,000000000013263e 00000000001325fc: eb880002000c srlg %r8,%r8,2 #0000000000132602: b2210051 ipte %r5,%r1,%r0,0 >0000000000132606: b90400d1 lgr %r13,%r1 000000000013260a: 41605008 la %r6,8(%r5) 000000000013260e: a7db1000 aghi %r13,4096 0000000000132612: b221006d ipte %r6,%r13,%r0,0 0000000000132616: e3d0d0000171 lay %r13,4096(%r13)
Call Trace: __kernel_map_pages+0x14e/0x320 __free_pages_ok+0x23a/0x5a8) free_low_memory_core_early+0x214/0x2c8 memblock_free_all+0x28/0x58 mem_init+0xb6/0x228 mm_core_init+0xb6/0x3b0 start_kernel+0x1d2/0x5a8 startup_continue+0x36/0x40 Kernel panic - not syncing: Fatal exception: panic_on_oops
This is caused by using large mappings on machines with EDAT1/EDAT2. Add the code to split the mappings into 4k pages if debug pagealloc is enabled by CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT or the debug_pagealloc kernel command line option.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54278 affects the Linux kernel's handling of memory management on s390 architecture systems, specifically when debug pagealloc functionality is enabled. This issue manifests as a kernel panic during early boot stages, demonstrating a critical flaw in how the kernel manages memory mappings when DAT (Data Address Translation) is enabled. The problem occurs in systems utilizing EDAT1/EDAT2 (Extended Data Address Translation) capabilities where large memory mappings conflict with debug pagealloc mechanisms.
The technical root cause stems from the interaction between the s390 architecture's memory management subsystem and the kernel's debug pagealloc feature. When debug pagealloc is enabled through either CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT configuration or the debug_pagealloc kernel command line parameter, the kernel attempts to manage memory pages with enhanced debugging capabilities. However, the implementation fails to properly handle large memory mappings that are common in s390 systems with EDAT1/EDAT2 support, leading to addressing exceptions during kernel initialization.
The operational impact of this vulnerability is severe as it prevents successful system boot on affected s390 systems. The kernel panic occurs at the very early stages of boot process, specifically during the mem_init function execution, making it impossible for the system to reach operational state. This vulnerability affects systems that rely on s390 architecture's advanced memory management features while also requiring kernel debugging capabilities for development or diagnostic purposes. The crash occurs with specific instruction sequences involving ipte (invalidate page table entry) operations and memory address translation, indicating a direct conflict between page mapping strategies and debugging mechanisms.
The fix implemented addresses this by introducing code to split large memory mappings into 4k pages when debug pagealloc is enabled, specifically targeting systems with EDAT1/EDAT2 capabilities. This approach aligns with CWE-129, which addresses improper validation of array indices, and follows ATT&CK techniques related to privilege escalation through kernel exploitation. The solution ensures that memory management operations remain compatible with debugging features while maintaining system stability and security. The patch effectively prevents the kernel from attempting incompatible memory mapping operations during boot, allowing systems to initialize properly regardless of debug pagealloc settings. This remediation maintains the integrity of the s390 architecture's memory management while preserving the debugging capabilities required for system development and maintenance.